Live › vulnerability › CVE-2026-120059
psqlODBC, the PostgreSQL ODBC driver, puts a server-reported column name into a printf-style format string when building WHERE clauses for updatable cursors on tables without OIDs that have an auto-increment int4 column. A crafted column name can make the driver read unrelated memory, crashing the application or copying client memory into query text sent to the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Applications that use the psqlODBC driver with updatable cursors over PostgreSQL tables without OIDs that have an auto-increment int4 column. Exposure rises if the application connects to a server not trusted under current SSL settings, or reads tables that any database user can create. Systems that do not use this driver or these cursor patterns can skip it.
No product ranges from the sources yet.
18.00.0006.18.00.0006 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-120059")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.