CVE-2026-109448: psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
psqlODBCto a version that resolves this vulnerability.Fixed in 18.00.0005 - Configuration
Ensure SQLBindParameter rejects parameter numbers outside 1..32767 with SQLSTATE 07009 (invalid descriptor index).
psqlODBC SQLBindParameter accepted parameter number range = 1..32767
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using psqlODBC before 18.00.0005 are exposed if they construct a single statement with more than 32767 bound parameters. This is particularly relevant where untrusted input can control parameter-list size, such as dynamically generated IN (?, ?, ...) clauses.
What does an attacker need to trigger the memory corruption?
An attacker must be able to cause the application to bind at least 32769 parameters on one statement. No authentication or user interaction is required according to the supplied vector, but exploitation depends on the application allowing that parameter count.
What happens when the vulnerable parameter count is reached?
Binding parameter 32768 causes the signed 16-bit binding count to wrap to -32768. Binding parameter 32769 then writes roughly 2.5 MB of zeros beginning about 1.25 MB before the binding array, causing an application crash or heap corruption.
What should be done if the driver cannot be updated immediately?
Ensure application logic limits each statement to 32767 or fewer bound parameters. In particular, constrain untrusted input that can expand dynamically generated parameter lists and split large operations into multiple statements.
How can teams determine whether they are affected?
Check whether the deployed psqlODBC version is earlier than 18.00.0005 and review application paths that generate large parameterized statements. Systems are affected when such paths can bind more than 32767 parameters in one statement.