---
id: CVE-2026-120063
title: psqlODBC stack buffer overflow when quoting long schema and table names
summary: >-
  When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its
  length check lets it write up to two bytes past the end of the buffer for a
  long name. The names come from the application's SQL text: the table of a
  statement…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-121
  - CWE-787
vendor: PostgreSQL
product: psqlODBC
affected:
  - psqlODBC < 18.00.0006
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T19:36:05.190717Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T19:36:16.948Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120063'
references:
  - url: >-
      https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-285r-84w3-xcxv
tags:
  - cve.org
epss: 0.00271
epssPercentile: 0.19427
ingestedAt: '2026-11-05T19:30:42.803Z'
---

## Overview

When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.

## Affected

- `psqlODBC < 18.00.0006`

## Remediation

Upgrade to psqlODBC 18.00.0006 or later. identifierEscape bounds every write to the output buffer, including the closing quote and the terminator.

### Workarounds

Do not pass SQL text from untrusted sources to the driver.