Skip to content
CVE Tracker
Back

CVE-2026-120063

psqlODBC stack buffer overflow when quoting long schema and table names

Medium5.9
Published
Updated
Reserved
Assigned by
PostgreSQL

Description

When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.

Scores

CVSS scores of CVE-2026-120063, by who scored it
Scored byCVSSScoreVector
PostgreSQLCNA (assigner)3.1Medium5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
NVDNVD · Awaiting Analysis3.1Medium5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS (exploitation in 30 days)
Not scored
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

Affected products

  • PostgreSQL · psqlODBC

    • affected < 18.00.0006

What to do

Solution: Upgrade to psqlODBC 18.00.0006 or later. identifierEscape bounds every write to the output buffer, including the closing quote and the terminator.

Workaround: Do not pass SQL text from untrusted sources to the driver.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .