CVE-2026-120064High· 7.5▾ TwilightSeveral psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the arra…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.
psqlODBC < 18.00.0006Upgrade to psqlODBC 18.00.0006 or later. SQLBindCol rejects column numbers above 32767 with SQLSTATE 07009, a negative descriptor count is ignored, and the column and row indexes are range-checked.
Validate column numbers (1..32767 and within the result set) and row numbers (within the rowset) in the application before calling the driver.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109448Medium· 5.9Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory
CVE-2026-6473High· 8.8Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds
CVE-2026-120057High· 7.5psqlODBC large-object read overflows the application buffer
CVE-2026-120060Medium· 5.9psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120066Medium· 5.3psqlODBC log files are created with default permissions at a predictable path and follow symbolic links
CVE-2026-120063Medium· 5.9psqlODBC stack buffer overflow when quoting long schema and table names