CVE-2026-120067

Name of the Vulnerable Software and Affected Versions psqlODBC versions prior to 18.00.0006

Description For updatable cursors, which are enabled by default, the driver adds hidden ctid and oid columns to the query. The driver copies each value into a 32-byte stack buffer using the length sent by the server without verifying it against the buffer size. A value of 32 bytes or more can cause a buffer overflow, writing past the buffer. This can be triggered by a server not trusted under current SSL settings or by a database user capable of creating a view with a column named ctid that the application reads using an updatable cursor. Depending on the build, this may result in an application abort or the overwriting of adjacent stack memory.

Recommendations Update to psqlODBC version 18.00.0006 or later.