Red Hat Product Security released an advisory (RHSA-2025:15012) addressing two vulnerabilities in PostgreSQL 12 (CVE-2025-8714 and CVE-2025-8715) that allow arbitrary code execution during the restore operation. These vulnerabilities are classified under CWE-829 and CWE-93, indicating improper control of code execution and code injection risks. The advisory covers Red Hat Enterprise Linux 8.8 variants including Extended Update Support Extension, Update Services for SAP Solutions, and Telecommunications Update Service. Red Hat provides updated PostgreSQL 12 packages to remediate these issues. No CVSS score is provided in the advisory, but the severity is rated as Important by Red Hat and high in the source data. The advisory includes detailed package updates and references for applying the fix.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code during the PostgreSQL restore operation, potentially leading to full compromise of the database server. This impacts the confidentiality, integrity, and availability of the database system. The vulnerabilities affect PostgreSQL 12 on Red Hat Enterprise Linux 8.8 platforms. No known exploits in the wild have been reported at this time.

Red Hat has released updated PostgreSQL 12 packages for Red Hat Enterprise Linux 8.8 that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2025:15012 and the referenced article https://access.redhat.com/articles/11258. Since an official fix is available, applying the update is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.