CVE-2026-120061High· 7.5▾ TwilightThe psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments ove…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.
psqlODBC < 18.00.0006Upgrade to psqlODBC 18.00.0006 or later. The argument offset array is initialized and bounded, and the escape body copy reserves room for the terminator.
Do not pass SQL text from untrusted sources to the driver, or reject text containing ODBC escape sequences ({fn ...}, {d ...}, {t ...}, {ts ...}, {escape ...}) before it reaches the driver.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120063Medium· 5.9psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120067Medium· 5.9psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
CVE-2026-120057High· 7.5psqlODBC large-object read overflows the application buffer
CVE-2026-120060Medium· 5.9psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120064High· 7.5psqlODBC does not validate column numbers and row indexes in binding and descriptor functions
CVE-2026-120066Medium· 5.3psqlODBC log files are created with default permissions at a predictable path and follow symbolic links