CVE-2026-120057High· 7.5▾ TwilightpsqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.
psqlODBC < 18.00.0006Upgrade to psqlODBC 18.00.0006 or later. CC_send_function receives the caller's buffer size, clamps the copy to it, and rejects short fixed-size replies.
Do not fetch large-object (lo) columns from servers that are not authenticated with sslmode=verify-full or an equivalent GSS setting.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120060Medium· 5.9psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120064High· 7.5psqlODBC does not validate column numbers and row indexes in binding and descriptor functions
CVE-2026-120066Medium· 5.3psqlODBC log files are created with default permissions at a predictable path and follow symbolic links
CVE-2026-120063Medium· 5.9psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120062High· 7.5psqlODBC SQL injection through SQLSpecialColumns table and schema names
CVE-2026-120065High· 7.1psqlODBC does not escape a server-supplied column name in its updatable-cursor queries