CVE-2026-120058High· 7.5▾ TwilightpsqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a lat…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.
psqlODBC < 18.00.0006Upgrade to psqlODBC 18.00.0006 or later. The driver rejects a column count that changes between fetches of the same cursor, and a keyset reply with fewer columns than the key fields.
Set UseDeclareFetch=0, or connect only to servers authenticated with sslmode=verify-full or an equivalent GSS setting.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120060Medium· 5.9psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120063Medium· 5.9psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120067Medium· 5.9psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
CVE-2026-120057High· 7.5psqlODBC large-object read overflows the application buffer
CVE-2026-120064High· 7.5psqlODBC does not validate column numbers and row indexes in binding and descriptor functions
CVE-2026-120066Medium· 5.3psqlODBC log files are created with default permissions at a predictable path and follow symbolic links