Live › vulnerability › CVE-2026-120058
psqlODBC sizes its row cache from the first result's column count but trusts later FETCH replies without checking them. A server the client does not trust can send a later reply with more columns and make the driver write past a heap allocation, or underflow a field count on keyset replies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Applications that use the psqlODBC driver to connect to PostgreSQL, especially with UseDeclareFetch enabled and a server that is not fully trusted under current SSL settings. Systems that connect only to trusted, verified PostgreSQL servers with default settings are less exposed. The sources do not say whether default settings enable UseDeclareFetch.
No product ranges from the sources yet.
18.00.0006.UseDeclareFetch is enabled in the DSN or connection string.18.00.0006 are affected; move to 18.00.0006 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-120058")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.