PostgreSQL up to 17.4 GB18030 Encoding Validation buffer over-read

Summaryinfo

A vulnerability has been found in PostgreSQL up to 13.20/14.17/15.12/16.8/17.4 and classified as critical. This impacts an unknown function of the component GB18030 Encoding Validation. Performing a manipulation results in buffer over-read. This vulnerability is identified as CVE-2025-4207. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in PostgreSQL up to 13.20/14.17/15.12/16.8/17.4. It has been classified as critical. This affects an unknown part of the component GB18030 Encoding Validation. The manipulation with an unknown input leads to a buffer over-read vulnerability. CWE is classifying the issue as CWE-126. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This is going to have an impact on availability. The summary by CVE is:

Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.

It is possible to read the advisory at postgresql.org. This vulnerability is uniquely identified as CVE-2025-4207 since 05/02/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 235668 (Debian dla-4159 : libecpg-compat3 - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 13.21, 14.18, 15.13, 16.9 or 17.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (235668) and CERT Bund (WID-SEC-2025-0986). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Ubuntu Linux
• SUSE Linux
• SUSE openSUSE
• Broadcom Brocade SANnav
• Hitachi Ops Center
• Open Source PostgreSQL

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 13.0
• 13.1
• 13.2
• 13.3
• 13.4
• 13.5
• 13.6
• 13.7
• 13.8
• 13.9
• 13.10
• 13.11
• 13.12
• 13.13
• 13.14
• 13.15
• 13.16
• 13.17
• 13.18
• 13.19
• 13.20
• 14.0
• 14.1
• 14.2
• 14.3
• 14.4
• 14.5
• 14.6
• 14.7
• 14.8
• 14.9
• 14.10
• 14.11
• 14.12
• 14.13
• 14.14
• 14.15
• 14.16
• 14.17
• 15.0
• 15.1
• 15.2
• 15.3
• 15.4
• 15.5
• 15.6
• 15.7
• 15.8
• 15.9
• 15.10
• 15.11
• 15.12
• 16.0
• 16.1
• 16.2
• 16.3
• 16.4
• 16.5
• 16.6
• 16.7
• 16.8
• 17.0
• 17.1
• 17.2
• 17.3
• 17.4

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion