CVE-2026-109448

Name of the Vulnerable Software and Affected Versions psqlODBC versions prior to 18.00.0005

Description An integer wraparound in the SQLBindParameter() function occurs because the binding count is stored in a signed 16-bit field. When the 32,768th parameter is bound, the count wraps to -32,768. Subsequently, binding the 32,769th parameter causes approximately 2.5 MB of zeros to be written starting 1.25 MB before the binding array. This leads to heap memory corruption, which can crash the application or leave it in an unstable state. Applications that generate parameter lists from untrusted input, such as an IN list, are particularly exposed.

Recommendations Update to version 18.00.0005 or later.