# CVE-2025-8713

## Summary

- **CVE ID:** CVE-2025-8713
- **Severity:** LOW
- **CVSS Score:** 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **CWE:** CWE-1230
- **Published:** Aug 14, 2025
- **Last Modified:** Mar 12, 2026

## Description

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access.  Separately, statistics allow a user to read sampled data that a row security policy intended to hide.  PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process.  Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies.  Reachable statistics data notably included histograms and most-common-values lists.  CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

## Affected Products

- n/a — PostgreSQL (17)
- n/a — PostgreSQL (16)
- n/a — PostgreSQL (15)
- n/a — PostgreSQL (14)
- n/a — PostgreSQL (0)

## References

- [CNA](https://www.postgresql.org/support/security/CVE-2025-8713/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.22%
- **EPSS Percentile:** 13.1

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._