CVE-2026-120063Medium· 5.9▾ SunlitWhen psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.
psqlODBC < 18.00.0006Upgrade to psqlODBC 18.00.0006 or later. identifierEscape bounds every write to the output buffer, including the closing quote and the terminator.
Do not pass SQL text from untrusted sources to the driver.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120067Medium· 5.9psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
CVE-2026-120061High· 7.5psqlODBC ODBC escape parser stack buffer overflow
CVE-2026-120058High· 7.5psqlODBC row cache overflow when a later FETCH changes the column count
CVE-2026-120057High· 7.5psqlODBC large-object read overflows the application buffer
CVE-2026-120060Medium· 5.9psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120064High· 7.5psqlODBC does not validate column numbers and row indexes in binding and descriptor functions