CVE-2026-120060

MediumCVSS 5.9/10Last modified Nov 2, 2026

Description

psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125 CWE-191

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
PostgreSQL	psqlODBC	< 18.00.0006

References

https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-4mfx-cfxx-c877

Timeline

Published: Nov 2, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1200617.5The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry sta CVE-2026-1200627.5SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other c CVE-2026-1200635.9When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the CVE-2026-1200647.5Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol wit CVE-2026-1200657.1For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It pla CVE-2026-1200665.3On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, an CVE-2026-1200675.9For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copie CVE-2026-120078.8Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted CVE-2026-1200708.8The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin f CVE-2026-1200757.2The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to ins CVE-2026-120088.3Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer pro CVE-2026-1200827.2The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Sc