CVE-2026-120062High· 7.5▾ TwilightSQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQL…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.
psqlODBC < 18.00.0006Upgrade to psqlODBC 18.00.0006 or later. SQLSpecialColumns passes the escaped names to its catalog queries, as the other catalog functions do.
Validate table and schema names against the catalog, or reject names containing quote characters or backslashes, before calling SQLSpecialColumns.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120065High· 7.1psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
CVE-2026-120057High· 7.5psqlODBC large-object read overflows the application buffer
CVE-2026-120060Medium· 5.9psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120064High· 7.5psqlODBC does not validate column numbers and row indexes in binding and descriptor functions
CVE-2026-120066Medium· 5.3psqlODBC log files are created with default permissions at a predictable path and follow symbolic links
CVE-2026-120063Medium· 5.9psqlODBC stack buffer overflow when quoting long schema and table names