Skip to content
CVE Tracker
Back

CVE-2026-120058

psqlODBC row cache overflow when a later FETCH changes the column count

High7.5
Published
Updated
Reserved
Assigned by
PostgreSQL

Description

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.

Scores

CVSS scores of CVE-2026-120058, by who scored it
Scored byCVSSScoreVector
PostgreSQLCNA (assigner)3.1High7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Awaiting Analysis3.1High7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
Not scored
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • PostgreSQL · psqlODBC

    • affected < 18.00.0006

What to do

Solution: Upgrade to psqlODBC 18.00.0006 or later. The driver rejects a column count that changes between fetches of the same cursor, and a keyset reply with fewer columns than the key fields.

Workaround: Set UseDeclareFetch=0, or connect only to servers authenticated with sslmode=verify-full or an equivalent GSS setting.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .