PostgreSQL Anonymizer EUVD-2026-72143

Exploitation requires the attacker to hold table-owner privilege within a PostgreSQL instance where PostgreSQL Anonymizer prior to 3.2.0 is installed and anon.anonymize_database_parallel() is in use. The CVSS UI:R metric indicates that a privileged user (likely a superuser or DBA) must actively invoke the parallel anonymization function for the exploit payload to execute. Attack complexity is high (AC:H), implying specific preconditions or timing windows. Exploitation is limited entirely to databases running the affected extension - standard PostgreSQL installations without this extension are unaffected. Environments where table ownership is restricted to trusted administrators and parallel anonymization is never invoked by superusers are not practically exploitable.

The vendor-supplied CVSS 3.1 score of 6.4 (AV:N/AC:H/PR:H/UI:R/S:U) reflects tightly constrained exploitation: the attacker must already hold high privileges (PR:H per vendor), attack complexity is high, and user interaction is required - factors that significantly reduce practical exploitability versus the C:H/I:H/A:H impact metrics alone. No EPSS score was provided in the input data, so exploitation probability is not independently quantifiable. The absence of a CISA KEV listing and no public POC further depresses urgency. Scope is marked unchanged (S:U) in the vendor vector, though an argument exists for S:C since escalation from table-owner to superuser crosses a principal trust boundary within the PostgreSQL cluster. Practically, this vulnerability is most dangerous in shared or multi-tenant PostgreSQL environments where untrusted users hold table ownership and an operator periodically invokes parallel anonymization operations - a deployment profile that is not uncommon in analytics or data-staging pipelines. The primary risk signal here is the severity of the outcome (full superuser compromise) rather than ease of exploitation.

A table owner in a shared analytics environment defines a masking rule or anonymization configuration that embeds a malicious payload. When a superuser or privileged operator later invokes anon.anonymize_database_parallel() across the database, the function executes the table owner's payload under superuser context, granting the attacker full database administrative access. No public POC exists at time of analysis. The AC:H and UI:R constraints mean the attacker must wait for or socially engineer a privileged invocation of the parallel anonymization workflow.