UBUNTU-CVE-2026-120057: High severity ubuntu/psqlodbc vulnerability
psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
psqlODBCto a version that resolves this vulnerability.Fixed in 18.00.0006
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Client processes using psqlODBC before 18.00.0006 are exposed when they fetch a large-object column from a server that is not trusted under the current SSL settings, or when a man-in-the-middle can alter the server response.
What does an attacker need to exploit this?
The attacker must be able to make the client receive a crafted large-object read response, either by controlling an insufficiently trusted server or by acting as a man-in-the-middle. No client-side privileges are required, but a user must fetch a large-object column.
What should be prioritized for remediation?
Upgrade psqlODBC to version 18.00.0006 or later. Until patching is possible, reduce exposure by ensuring connections use SSL settings that trust the intended server and prevent man-in-the-middle interception, and avoid fetching large-object columns from untrusted connections.
How can I determine whether a client is affected?
A client is affected if it uses psqlODBC earlier than 18.00.0006 and fetches large-object columns over a connection where the server is not trusted under the configured SSL settings or interception is possible.