UBUNTU-CVE-2026-120067: Medium severity ubuntu/psqlodbc vulnerability
For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with FORTIFYSOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
psqlODBCto a version that resolves this vulnerability.Fixed in 18.00.0006
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using psqlODBC versions before 18.00.0006 are affected when applications use updatable cursors, which are enabled by default. Exposure exists if the application connects to a server that is not trusted under its current SSL settings, or if an untrusted database user can create a view with a column named ctid that the application reads through an updatable cursor.
Does exploitation require an authenticated attacker?
Not necessarily. A network-reachable server that is not trusted under the current SSL configuration can provide the oversized value without database-user privileges; alternatively, exploitation can be performed by a database user able to create a crafted view.
What is the impact on systems built with stack protections?
Builds using _FORTIFY_SOURCE abort when the oversized value is copied, resulting in a denial of service. Builds without _FORTIFY_SOURCE can overwrite adjacent stack memory.
What can be done while patching is pending?
Avoid using updatable cursors where possible, and do not connect through SSL configurations that permit untrusted servers. Restrict database users from creating views that could be read by affected applications.