psqlODBC large-object read overflows the application buffer

Description

psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.

Scores

EPSS (exploitation in 30 days)

Not scored

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)

Affected products

• PostgreSQL · psqlODBC

  • affected < 18.00.0006

What to do

Solution: Upgrade to psqlODBC 18.00.0006 or later. CC_send_function receives the caller's buffer size, clamps the copy to it, and rejects short fixed-size replies.

Workaround: Do not fetch large-object (lo) columns from servers that are not authenticated with sslmode=verify-full or an equivalent GSS setting.

References (1)

• https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-qhmr-5339-q33r (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 2 Nov 2026, 19:43 UTC.