UBUNTU-CVE-2026-120064: High severity ubuntu/psqlodbc vulnerability
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQLDESCCOUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQLADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
psqlODBCto a version that resolves this vulnerability.Fixed in 18.00.0006
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications using psqlODBC before 18.00.0006 are exposed when they pass column numbers or row indexes derived from untrusted input into the affected ODBC calls. The vulnerability affects the application process using the driver, rather than requiring a malicious database server.
What access does an attacker need to exploit it?
An attacker needs a way to influence column numbers or row indexes supplied by an application to affected psqlODBC entry points. The severity vector indicates network access, low privileges, no user interaction, and high attack complexity.
Are default configurations affected?
The available information does not identify a configuration-dependent condition. Exposure depends on whether an application forwards untrusted column or row values to functions including SQLBindCol, SQLColAttribute, SQLSetPos with SQL_ADD, or application row-descriptor operations.
What can be done before upgrading?
Ensure applications validate column numbers and row indexes before passing them to psqlODBC, rejecting negative, excessively large, or rowset-out-of-range values. Upgrade to psqlODBC 18.00.0006 or later when possible.
How can I determine whether an application may be affected?
Check whether it uses a psqlODBC version earlier than 18.00.0006 and whether its ODBC call paths accept externally controlled column numbers, descriptor counts, or row indexes. In particular, review uses of SQLBindCol, SQLColAttribute, SQLSetPos(SQL_ADD), and application row descriptors.