CVE-2026-120067: Medium severity debian/psqlodbc vulnerability
For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with FORTIFYSOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this in a typical deployment?
A server that is not trusted under the current SSL settings can send an oversized value. A database user can also trigger it if they can create a view with a column named ctid that an application reads through an updatable cursor.
Is the default configuration affected?
Yes. Updatable cursors are enabled by default, and psqlODBC adds hidden ctid columns to queries for those cursors. Tables with OIDs also cause an oid column to be added.
What happens when the issue is triggered?
Builds using _FORTIFY_SOURCE abort when the oversized value is copied. Other builds overwrite adjacent stack memory, while the stated impact is denial of service.
What version should be deployed to address this issue?
Versions before psqlODBC 18.00.0006 are affected, so deploy 18.00.0006 or later.