CVE-2025-8713lowCWE-1230

CVE-2025-8713: low-severity vulnerability in PostgreSQL

PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table

Published

Follow this CVE+ Monitor PostgreSQL+ Monitor postgresql15

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.1epss 0.3%
In short

PostgreSQL's query optimizer stores statistical summaries of table data (like common values and patterns) that can be accessed through specially crafted functions, potentially revealing information from tables or rows a user shouldn't see, even if they lack direct permission.

Technical detail

A local attacker can craft custom operators to extract sensitive data from PostgreSQL optimizer statistics (histograms, most-common-values) by bypassing view ACLs and row-level security policies in inheritance hierarchies. This requires database access and ability to define functions, exposing sampled column data through the query planner's statistical references.

Summary generated and translated by AI from the official description.
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
n/a · PostgreSQL