This advisory addresses three related vulnerabilities in PostgreSQL 15 that enable arbitrary code execution during database restore operations (CVE-2025-8713, CVE-2025-8714, CVE-2025-8715). These vulnerabilities could allow an attacker to execute code within the context of the PostgreSQL process when a restore operation is performed. Red Hat has released an update for the postgresql:15 module in Red Hat Enterprise Linux 9.2 to fix these issues. The advisory references Red Hat Bugzilla entries BZ-2388551 and BZ-2388553 for the specific fixes related to CVE-2025-8715 and CVE-2025-8714 respectively. No CVSS scores are provided in the advisory, but the severity is rated as important.

Successful exploitation of these vulnerabilities could lead to arbitrary code execution on systems running vulnerable versions of PostgreSQL 15 during restore operations. This could compromise the confidentiality, integrity, and availability of the affected database systems. The advisory does not report known exploits in the wild at the time of publication.

Red Hat has released an official security update for the postgresql:15 module in Red Hat Enterprise Linux 9.2 that addresses these vulnerabilities. Users should apply this update promptly following Red Hat's published guidance (https://access.redhat.com/articles/11258). No additional mitigations are indicated in the advisory. Patch status is confirmed as an official fix available from Red Hat.