{"id":"CVE-2026-120059","kind":"vulnerability","aliases":["CVE-2026-120059"],"related":[],"title":"psqlODBC: column names with format directives leak client memory into queries","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.","summary":"psqlODBC, the PostgreSQL ODBC driver, puts a server-reported column name into a printf-style format string when building WHERE clauses for updatable cursors on tables without OIDs that have an auto-increment int4 column. A crafted column name can make the driver read unrelated memory, crashing the application or copying client memory into query text sent to the server.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","odbc","package","postgresql","psqlodbc","windows"],"not_affected_if":["driver-18.00.0006-or-later","no-updatable-cursors","tables-with-oids"],"how_to_check":"- Check the installed psqlODBC driver version and confirm whether it is below `18.00.0006`.\n- Look for applications that use updatable cursors against PostgreSQL tables that lack OIDs and have auto-increment int4 columns.\n- Review whether the server connection is trusted under current SSL settings, and who can create tables that the application reads.","fix":"- psqlODBC: move to `18.00.0006` or later.","status":"open","published_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","triaged_at":"2026-11-02T19:26:47+00:00","updated_at":"2026-11-02T19:26:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T19:26:47Z","model":"claude-haiku-5-5","output":{"fix":"- psqlODBC: move to `18.00.0006` or later.","reach":"network","title":"psqlODBC: column names with format directives leak client memory into queries","impact":"medium","summary":"psqlODBC, the PostgreSQL ODBC driver, puts a server-reported column name into a printf-style format string when building WHERE clauses for updatable cursors on tables without OIDs that have an auto-increment int4 column. A crafted column name can make the driver read unrelated memory, crashing the application or copying client memory into query text sent to the server.","audience":"developers","category":"package","nicknames":[],"who_cares":["psqlodbc","postgresql","odbc","windows","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Application crashes or client memory is copied into queries sent to the server","analyst_note":"","how_to_check":"- Check the installed psqlODBC driver version and confirm whether it is below `18.00.0006`.\n- Look for applications that use updatable cursors against PostgreSQL tables that lack OIDs and have auto-increment int4 columns.\n- Review whether the server connection is trusted under current SSL settings, and who can create tables that the application reads.","plain_action":"","needs_analyst":false,"not_affected_if":["no-updatable-cursors","tables-with-oids","driver-18.00.0006-or-later"],"who_is_affected":"Applications that use the psqlODBC driver with updatable cursors over PostgreSQL tables without OIDs that have an auto-increment int4 column. Exposure rises if the application connects to a server not trusted under current SSL settings, or reads tables that any database user can create. Systems that do not use this driver or these cursor patterns can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4251,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120059':14A,17A '-2026':13A,16A '18.00.0006':207C 'affect':209C 'applic':75B,161C,198C 'argument':129C 'auto':58B,100C 'auto-incr':57B,99C 'build':44B,132C 'claus':46B,135C 'client':8A,78B,164C 'column':2A,34B,61B,64B,103C,107C,145C 'come':176C 'contain':148C 'copi':77B,163C 'craft':63B 'crash':73B,159C 'creat':193C 'current':183C 'cursor':49B,90C,203C 'cve':12A,15A 'databas':189C 'delet':142C 'direct':6A,150C 'driver':28B,69B,153C 'expand':124C 'format':5A,41B,120C,149C 'increment':59B,101C 'int4':60B,102C 'later':123C 'leak':7A 'linux':18B 'make':67B,151C 'memori':9A,72B,79B,156C,165C 'name':3A,35B,65B,109C,146C,174C 'odbc':19B,27B 'oid':53B,95C 'one':128C 'packag':20B 'place':105C 'posit':138C 'postgresql':21B,26B 'printf':39B,118C 'printf-styl':38B,117C 'psqlodbc':1A,22B,24B,104C,206C 'put':29B 'queri':11A,81B,167C 'read':70B,154C,199C 'report':33B,111C 'select':139C 'sent':83B,169C 'server':32B,86B,114C,172C,179C 'server-report':31B 'set':185C 'ssl':184C 'statement':143C 'string':42B,121C,126C 'style':40B,119C 'tabl':51B,93C,195C 'text':82B,168C 'trust':181C 'unrel':71B,155C 'updat':48B,89C,140C,202C 'user':190C 'version':204C 'window':23B 'without':52B,94C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the psqlODBC driver with updatable cursors over PostgreSQL tables without OIDs that have an auto-increment int4 column. Exposure rises if the application connects to a server not trusted under current SSL settings, or reads tables that any database user can create. Systems that do not use this driver or these cursor patterns can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linux","medium","odbc","package","postgresql","psqlodbc","windows"],"first_public_at":"2026-11-02T19:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120059","severity":null,"published_at":"2026-11-02T19:18:02+00:00","modified_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","fetched_at":"2026-11-02T19:24:39+00:00","note":null}],"documents":[{"id":53470,"url":"https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-44rq-72jh-x2h8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}