psqlODBC vulnerabilities

6 known vulnerabilities in psqlODBC from PostgreSQL. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  psqlODBC: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-120065Nov 2, 2026PostgreSQL

  For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of

• 7.5 High severity

  psqlODBC: Improper Validation of Array Index

  CVE-2026-120064Nov 2, 2026PostgreSQL

  Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_

• 7.5 High severity

  psqlODBC: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-120062Nov 2, 2026PostgreSQL

  SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the

• 7.5 High severity

  psqlODBC: Stack-based Buffer Overflow

  CVE-2026-120061Nov 2, 2026PostgreSQL

  The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a

• 7.5 High severity

  psqlODBC: Integer Underflow (Wrap or Wraparound)

  CVE-2026-120058Nov 2, 2026PostgreSQL

  psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more colu

• 7.5 High severity

  psqlODBC: Buffer Copy without Checking Size of Input

  CVE-2026-120057Nov 2, 2026PostgreSQL

  psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes