CVE-2026-120060Medium· 5.9▾ SunlitpsqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without b…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.
psqlODBC < 18.00.0006Upgrade to psqlODBC 18.00.0006 or later. The row count, the index-key count, and the octal escape length are checked before use.
Connect only to servers authenticated with sslmode=verify-full or an equivalent GSS setting.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120058High· 7.5psqlODBC row cache overflow when a later FETCH changes the column count
CVE-2026-120057High· 7.5psqlODBC large-object read overflows the application buffer
CVE-2026-120064High· 7.5psqlODBC does not validate column numbers and row indexes in binding and descriptor functions
CVE-2026-120066Medium· 5.3psqlODBC log files are created with default permissions at a predictable path and follow symbolic links
CVE-2026-120063Medium· 5.9psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120062High· 7.5psqlODBC SQL injection through SQLSpecialColumns table and schema names