UBUNTU-CVE-2026-120061: High severity ubuntu/psqlodbc vulnerability
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
psqlODBCto a version that resolves this vulnerability.Fixed in 18.00.0006
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using psqlODBC that forward untrusted SQL text to the driver are exposed. The vulnerability affects the application's process, where malicious ODBC escape sequences can trigger memory corruption.
What does an attacker need to exploit it?
An attacker needs the ability to cause the application to send crafted SQL text containing ODBC escape sequences to psqlODBC. The reported vector is network-based, requires low privileges, and does not require user interaction, but exploitation has high complexity.
Are affected versions identified?
Versions of psqlODBC before 18.00.0006 are affected. Systems using version 18.00.0006 or later are not identified as affected by the provided advisory details.
What is the practical impact of successful exploitation?
Crafted {fn} escapes can overflow a stack array and cause arbitrary bytes to be copied into the query, while certain other escape bodies can write past a stack buffer. The reported impact includes high confidentiality, integrity, and availability effects.