Red Hat Product Security released an advisory (RHSA-2025:15012) addressing two vulnerabilities in PostgreSQL 12 (CVE-2025-8714 and CVE-2025-8715) that allow arbitrary code execution during database restore operations. These vulnerabilities affect PostgreSQL 12 packages on Red Hat Enterprise Linux 8.8 variants including Extended Life Cycle Long Life, Update Services for SAP Solutions, and Telecommunications Update Service. The advisory rates the impact as Important and provides updated packages to remediate the issues. The vulnerabilities are related to improper handling in the restore operation that could lead to execution of arbitrary code. No CVSS score is currently available for these CVEs.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code during the PostgreSQL restore operation, potentially compromising the affected system. This represents a significant security risk as it may lead to unauthorized control over the database server or underlying host.

Red Hat has released updated PostgreSQL 12 packages for Red Hat Enterprise Linux 8.8 that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. Since a fix is available, applying the update is the recommended mitigation. No additional vendor advisories indicate that no action is required or that the issue is already mitigated.