CVE-2026-120064: Out-of-bounds Read
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQLDESCCOUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQLADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using psqlODBC before 18.00.0006 are exposed when they pass untrusted or insufficiently validated column numbers or row indexes into affected ODBC entry points. The vulnerable operations include SQLBindCol, SQLColAttribute, SQLSetPos(SQL_ADD), and descriptor handling involving SQL_DESC_COUNT.
What does an attacker need to exploit it?
An attacker needs a way to influence column numbers, row indexes, or an application row descriptor count supplied by the application to psqlODBC. Exploitation depends on the application forwarding those values without validating their range.
Are standard psqlODBC deployments affected by default?
The data does not indicate that ordinary use alone triggers the flaw. Exposure requires application-controlled values that are out of range, such as a SQLBindCol column number above 32767, a negative SQL_DESC_COUNT, a very large SQLColAttribute column number, or a SQLSetPos(SQL_ADD) row number beyond the rowset size.
What can be done if upgrading is not immediately possible?
Validate all column-number and row-index inputs before passing them to psqlODBC, and reject negative, excessively large, or rowset-out-of-range values. In particular, prevent SQLBindCol column values above 32767 and ensure SQLSetPos(SQL_ADD) row numbers do not exceed the rowset size.