psqlODBC uses a server-supplied column name as a format string

Description

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.

Scores

EPSS (exploitation in 30 days)

Not scored

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.

Weakness

• CWE-134 Use of Externally-Controlled Format String (opens in a new tab)

Affected products

• PostgreSQL · psqlODBC

  • affected < 18.00.0006

What to do

Solution: Upgrade to psqlODBC 18.00.0006 or later. Each percent sign in the server-supplied column name is doubled before the name is placed in the format string.

Workaround: Set UpdatableCursors=0 in the connection string or DSN, or use read-only cursors (SQL_CONCUR_READ_ONLY).

References (1)

• https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-44rq-72jh-x2h8 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 2 Nov 2026, 19:34 UTC.