← Back to Security Blog

Critical PostgreSQL Vulnerability CVE-2025-1094 Enables Remote Code Execution

A critical SQL injection flaw in PostgreSQL's libpq allows attackers to achieve remote code execution. CVSS 8.1 — all versions before 17.3, 16.7, 15.11, 14.16, 13.19 are affected. Patch immediately.

---

Executive Summary

A critical vulnerability tracked as CVE-2025-1094 has been discovered in PostgreSQL's libpq library, affecting the way SQL queries handle string escaping. The flaw allows an attacker to inject arbitrary SQL commands and, under certain configurations, achieve remote code execution (RCE) on the database server.

---

Technical Analysis

The Root Cause

The vulnerability exists in PostgreSQL's libpq functions — specifically PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn(). These functions are responsible for escaping user-supplied input before it's embedded into SQL queries.

The flaw arises from incorrect handling of invalid UTF-8 byte sequences. When a specially crafted string containing malformed UTF-8 is passed to these escaping functions, the quoting logic can be bypassed, allowing an attacker to break out of the string context and inject arbitrary SQL.

Exploitation Path

1. Entry Point: Any application using libpq that accepts user input and passes it through the escaping functions
2. Bypass: Attacker sends a crafted payload with invalid UTF-8 sequences that confuse the escaping logic
3. Injection: The malformed input breaks the SQL string boundary, allowing arbitrary SQL execution
4. RCE: Using PostgreSQL's COPY TO/FROM PROGRAM or custom function creation, the attacker can execute OS commands

Proof of Concept

Rapid7 researchers demonstrated that this vulnerability can be chained with BeyondTrust Remote Support CVE-2024-12356 for unauthenticated RCE.

---

Impact Assessment

Factor	Rating	Details
CVSS Score	8.1 (High)	Network-accessible, no authentication required in some configs
Exploitability	High	PoC available, active exploitation confirmed
Affected Installations	Massive	PostgreSQL powers ~35% of enterprise databases globally
Data Risk	Critical	Full database read/write, potential OS-level access

---

Remediation Steps

1. Patch immediately: Upgrade to PostgreSQL 17.3, 16.7, 15.11, 14.16, or 13.19
2. Audit applications: Search for use of PQescapeLiteral, PQescapeIdentifier, and related functions
3. Use parameterized queries: Prefer PQexecParams() over string concatenation with escaping
4. Network segmentation: Ensure PostgreSQL is not directly exposed to the internet
5. Monitor for exploitation: Watch for unusual COPY PROGRAM usage in query logs