What’s Vulnerable › Vulnerabilities

CVE-2025-4207: PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-08 · updated 2026-06-17
• Weakness: CWE-126

Description

Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.

Affected products

• PostgreSQL: from 17 before 17.5; from 16 before 16.9; from 15 before 15.13; from 14 before 14.18; before 13.21 — fixed in 13.21, 14.18, 15.13, 16.9, 17.5

How to fix

Upgrade to a fixed version: PostgreSQL 13.21, 14.18, 15.13, 16.9. Check the vendor advisory for mitigations.

References

• https://www.postgresql.org/support/security/CVE-2025-4207/
• http://www.openwall.com/lists/oss-security/2025/05/09/3
• https://lists.debian.org/debian-lts-announce/2025/05/msg00011.html

Get alerted when CVE-2025-4207 or the next vulnerability affects your stack