UBUNTU-CVE-2026-120059: Medium severity ubuntu/psqlodbc vulnerability
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
psqlODBCto a version that resolves this vulnerability.Fixed in 18.00.0006
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using affected psqlODBC versions with updatable cursors against tables without OIDs that include an auto-increment int4 column are exposed. The vulnerable path is reached when the driver builds positioned SELECT, UPDATE, or DELETE statements.
What must an attacker be able to do?
An attacker can supply a malicious column name through a server that is not trusted under the current SSL settings, or by being a database user able to create a table that the application reads through an updatable cursor. The column name must contain printf-style format directives.
What is the impact if exploitation succeeds?
The driver may read unrelated client memory, which can crash the application or copy client memory into query text sent to the server. The stated impact includes high confidentiality and availability effects.
Are current psqlODBC releases affected?
Versions before psqlODBC 18.00.0006 are affected. Updating to 18.00.0006 or later removes the affected version range described here.
What can be done if an update cannot be applied immediately?
Avoid using updatable cursors on attacker-controlled or untrusted database tables, particularly tables without OIDs that have auto-increment int4 columns. Restrict who can create tables read by the application and avoid connections to servers not trusted under the current SSL settings.