UBUNTU-CVE-2026-120058: High severity ubuntu/psqlodbc vulnerability
psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
psqlODBCto a version that resolves this vulnerability.Fixed in 18.00.0006
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using psqlODBC versions before 18.00.0006 are affected when UseDeclareFetch is enabled. Exploitation also depends on connecting to a server that is not trusted under the current SSL settings.
What does an attacker need to do to exploit it?
An attacker needs to control or impersonate an untrusted PostgreSQL server connection and return a later FETCH response with a different column count than the cursor's first result. A malformed keyset reply with fewer columns than the key fields can also trigger an unsigned field-count underflow.
Is the default configuration affected?
The issue is described as reachable with UseDeclareFetch enabled. The provided data does not state whether that option is enabled by default.
What can be done if upgrading is not immediately possible?
Disable UseDeclareFetch where feasible and avoid connections to servers that are not trusted under the configured SSL settings. Upgrade psqlODBC to 18.00.0006 or later when possible.