Live › vulnerability › CVE-2026-120057
psqlODBC, the PostgreSQL ODBC driver, copies a server's reply to a large-object read into the application's buffer without checking its size. A malicious or man-in-the-middle server can overwrite adjacent client memory with bytes it chooses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Applications that connect to PostgreSQL through psqlODBC and read large-object columns are exposed, especially where the server is not fully trusted under the current SSL settings or traffic can be intercepted. Systems that never read large objects or only talk to fully trusted servers are less exposed, but the sources do not say this removes the risk.
No product ranges from the sources yet.
18.00.0006.18.00.0006 are affected; move to 18.00.0006 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-120057")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.