CVE-2026-120061: High severity debian/psqlodbc vulnerability
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using psqlODBC before version 18.00.0006 are exposed when they forward untrusted SQL text to the driver. The listed affected software includes the Ubuntu and Debian psqlodbc packages.
What must an attacker be able to do to exploit it?
An attacker needs the ability to cause an application to send crafted SQL text containing ODBC escape sequences to the psqlODBC driver. Exploitation can use a {fn} escape with excessive or missing arguments, or oversized {d}, {t}, {ts}, or {escape} bodies.
What is the potential impact?
The parser flaws can corrupt memory in the application process using the driver. The supplied severity vector indicates potential impact to confidentiality, integrity, and availability.