CVE-2026-120057

HighCVSS 7.5/10Last modified Nov 2, 2026

Description

psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
PostgreSQL	psqlODBC	< 18.00.0006

References

https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-qhmr-5339-q33r

Timeline

Published: Nov 2, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1200587.5psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply w CVE-2026-1200596.8For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by CVE-2026-1200605.9psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction CVE-2026-1200617.5The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry sta CVE-2026-1200627.5SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other c CVE-2026-1200635.9When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the CVE-2026-1200647.5Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol wit CVE-2026-1200657.1For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It pla CVE-2026-1200665.3On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, an CVE-2026-1200675.9For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copie CVE-2026-120078.8Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted CVE-2026-1200708.8The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin f