PostgreSQL is susceptible to a buffer overrun due to missing validation of multibyte character length during text manipulation. This allows a database user to craft queries that can overwrite memory, potentially leading to arbitrary code execution with the privileges of the operating system user running the database. The issue is triggered when processing maliciously crafted queries, specifically in the PL/pgsql function compilation when handling CREATE FUNCTION statements. An attacker with CREATE privilege can define a PL/Python user-defined function containing arbitrary Python code that executes with the privileges of the PostgreSQL server process. Approximately 3 million instances are estimated to be exposed globally. The vulnerability affects the `substring()` function, which may raise an error when processing non-ASCII text values sourced from database columns.