Live › vulnerability › CVE-2026-120061
The psqlODBC driver's parser for ODBC escape sequences writes past fixed-size stack buffers when it reads application SQL text, including {fn}, {d}, {t}, {ts} and {escape} forms. An attacker who controls SQL text sent to the driver can corrupt the process stack and copy arbitrary bytes into the query.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Applications that pass untrusted SQL text through the psqlODBC driver are exposed to memory corruption in their process. Systems where only trusted, fixed queries reach the driver are less exposed. unknown for exact trigger conditions beyond the description.
No product ranges from the sources yet.
odbcinst -j and the driver library path it lists.18.00.0006 or later (versions before 18.00.0006 are affected).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-120061")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.