---
id: "CVE-2026-120059"
kind: "vulnerability"
aliases: ["CVE-2026-120059"]
title: "psqlODBC: column names with format directives leak client memory into queries"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux", "odbc", "package", "postgresql", "psqlodbc", "windows"]
not_affected_if: ["driver-18.00.0006-or-later", "no-updatable-cursors", "tables-with-oids"]
published_at: "2026-11-02T19:18:02+00:00"
first_seen_at: "2026-11-02T19:24:39+00:00"
updated_at: "2026-11-02T19:26:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120059", "first_seen_at": "2026-11-02T19:24:39+00:00"}]
---

# psqlODBC: column names with format directives leak client memory into queries

psqlODBC, the PostgreSQL ODBC driver, puts a server-reported column name into a printf-style format string when building WHERE clauses for updatable cursors on tables without OIDs that have an auto-increment int4 column. A crafted column name can make the driver read unrelated memory, crashing the application or copying client memory into query text sent to the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed psqlODBC driver version and confirm whether it is below `18.00.0006`.
- Look for applications that use updatable cursors against PostgreSQL tables that lack OIDs and have auto-increment int4 columns.
- Review whether the server connection is trusted under current SSL settings, and who can create tables that the application reads.

## Fix

- psqlODBC: move to `18.00.0006` or later.

## Timeline

- 2026-11-02T19:24:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120059

## Documents

- [advisory] Vendor advisory: github.com https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-44rq-72jh-x2h8

## From the sources

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_