## Summary
Heap buffer overflow in PostgreSQL plperl tied hash handling can allow the function owner to execute arbitrary code as the operating system user running the database. Patch immediately: PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
## Technical Details
- Vulnerability type: heap buffer overflow (CWE-122)
- Component: PostgreSQL core server, plperl
- Trigger: plperl “return of a tied hash” when processing a crafted function body
- Privilege model: exploitation is tied to the function owner (attacker must have the ability to define/own the relevant function)
- Impacted execution context: arbitrary code runs as the operating system user running the PostgreSQL server process
## Affected
- PostgreSQL versions before:
- 18.5
- 17.11
- 16.15
- 15.19
- 14.24
## Impact
- Confidentiality: high (C:H)
- Integrity: high (I:H)
- Availability: high (A:H)
- Attack vector: network reachable (AV:N), with low complexity (AC:L) and low required privileges (PR:L)
- Overall severity: high (CVSS 8.8)
## Mitigation
1. Upgrade PostgreSQL to a fixed release: 18.5, 17.11, 16.15, 15.19, or 14.24 (or newer).
2. If immediate upgrade is not possible, restrict who can create/own plperl functions (since exploitation depends on the function owner capability).
3. Monitor for suspicious plperl function creation/changes by database roles, and review recent deployments of crafted function bodies.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-122