PostgreSQL intarray Extension Arbitrary Code Execution Vulnerability

A vulnerability in the PostgreSQL intarray extension's selectivity estimator function allows object creators to execute arbitrary code as the operating system user running the database. This issue arises from missing validation of input types. Affected versions include those prior to PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the server, executed as the operating system user running the PostgreSQL database.

Remediation

Users can upgrade to PostgreSQL versions 18.2, 17.8, 16.12, 15.16, or 14.21 to address this vulnerability.