Skip to content
CVE Tracker
Back

CVE-2026-120061

psqlODBC ODBC escape parser stack buffer overflow

High7.5
Published
Updated
Reserved
Assigned by
PostgreSQL

Description

The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.

Scores

CVSS scores of CVE-2026-120061, by who scored it
Scored byCVSSScoreVector
PostgreSQLCNA (assigner)3.1High7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Awaiting Analysis3.1High7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
Not scored
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • PostgreSQL · psqlODBC

    • affected < 18.00.0006

What to do

Solution: Upgrade to psqlODBC 18.00.0006 or later. The argument offset array is initialized and bounded, and the escape body copy reserves room for the terminator.

Workaround: Do not pass SQL text from untrusted sources to the driver, or reject text containing ODBC escape sequences ({fn ...}, {d ...}, {t ...}, {ts ...}, {escape ...}) before it reaches the driver.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .