5.9

CVE-2025-4207: postgresql-12 Buffer Over-read

CVSS: 5.9v3.1MediumDeferred
AliasesALPINE-CVE-2025-4207MGASA-2025-0155SUSE-SU-2025:01644-1
Published 08-05-2025Last modified 09-05-2025
Open JSON

Vulnerability summary

CVE-2025-4207 is a medium (CVSS 5.9) Buffer Over-read vulnerability in postgresql-12. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.4% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.76%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6
RHSA-2025:14826RHSA-2025:14827RHSA-2025:14862RHSA-2025:14899RHSA-2025:15021RHSA-2025:15022

Timeline

  1. 08-05-2025
    PublishedVulnerability first disclosed.
  2. 09-05-2025
    Last modifiedVulnerability information updated.

Description

Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.76%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

+0.03 pp

From 0.73% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.76%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse95 products
  • postgresql13&distro=SUSE Enterprise Storage 7.1< 13.21-150200.5.72.1
  • postgresql13&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 13.21-150200.5.72.1
  • postgresql13&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 13.21-150200.5.72.1
  • postgresql13&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 13.21-150200.5.72.1
  • postgresql13&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 13.21-3.63.1
Opensuse10 products
  • postgresql13&distro=openSUSE Leap 15.6< 13.21-150600.14.8.1
  • postgresql13&distro=openSUSE Tumbleweed< 13.21-1.1
  • postgresql14&distro=openSUSE Leap 15.6< 14.18-150600.16.17.1
  • postgresql14&distro=openSUSE Tumbleweed< 14.18-1.1
  • postgresql15&distro=openSUSE Leap 15.6< 15.13-150600.16.17.1
Ubuntu7 products
  • postgresql-10All versions (No fix recorded)
  • postgresql-12< 12.22-0ubuntu0.20.04.4
  • postgresql-14< 14.18-0ubuntu0.22.04.1
  • postgresql-16< 16.9-0ubuntu0.24.04.1
  • postgresql-17< 17.5-0ubuntu0.25.04.1
Alpine4 products
  • postgresql14< 14.18-r0
  • postgresql15< 15.13-r0
  • postgresql16< 16.9-r0
  • postgresql17< 17.5-r0
Debian3 products
  • postgresql-13< 13.21-0+deb11u1
  • postgresql-15< 15.13-0+deb12u1
  • postgresql-17< 17.5-1
Mageia2 products
  • postgresql13< 13.21-1.mga9
  • postgresql15< 15.13-1.mga9
Chainguard1 product
  • postgresql-12All versions (No fix recorded)
Wolfi1 product
  • postgresql-12All versions (No fix recorded)

8 vendors · 123 products

References

40 links
Show all 40 references