{"id":"CVE-2026-120061","kind":"vulnerability","aliases":["CVE-2026-120061"],"related":[],"title":"psqlODBC: crafted ODBC escape sequences corrupt memory in client applications","description":"The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.","summary":"The psqlODBC driver's parser for ODBC escape sequences writes past fixed-size stack buffers when it reads application SQL text, including {fn}, {d}, {t}, {ts} and {escape} forms. An attacker who controls SQL text sent to the driver can corrupt the process stack and copy arbitrary bytes into the query.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["odbc","package","postgresql","psqlodbc"],"not_affected_if":["fixed-version","trusted-sql-only"],"how_to_check":"- Find the psqlODBC driver version on the host, for example with `odbcinst -j` and the driver library path it lists.\n- Check whether any application forwards untrusted or user-supplied SQL text to the driver.","fix":"- psqlODBC: move to `18.00.0006` or later (versions before `18.00.0006` are affected).","status":"open","published_at":"2026-11-02T19:18:03+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","triaged_at":"2026-11-02T19:26:40+00:00","updated_at":"2026-11-02T19:26:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T19:26:40Z","model":"claude-haiku-5-5","output":{"fix":"- psqlODBC: move to `18.00.0006` or later (versions before `18.00.0006` are affected).","reach":"unknown","title":"psqlODBC: crafted ODBC escape sequences corrupt memory in client applications","impact":"high","summary":"The psqlODBC driver's parser for ODBC escape sequences writes past fixed-size stack buffers when it reads application SQL text, including {fn}, {d}, {t}, {ts} and {escape} forms. An attacker who controls SQL text sent to the driver can corrupt the process stack and copy arbitrary bytes into the query.","audience":"developers","category":"package","nicknames":[],"who_cares":["psqlodbc","postgresql","odbc"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker corrupts process memory and alters queries via the driver","analyst_note":"","how_to_check":"- Find the psqlODBC driver version on the host, for example with `odbcinst -j` and the driver library path it lists.\n- Check whether any application forwards untrusted or user-supplied SQL text to the driver.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-sql-only","fixed-version"],"who_is_affected":"Applications that pass untrusted SQL text through the psqlODBC driver are exposed to memory corruption in their process. Systems where only trusted, fixed queries reach the driver are less exposed. unknown for exact trigger conditions beyond the description.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4249,"output_tokens":558,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120061':13A,16A '-2026':12A,15A '128':146C '16':95C '18.00.0006':169C 'affect':171C 'also':140C 'applic':10A,40B,81C,151C 'arbitrari':68B,125C 'argument':86C,113C,123C 'array':98C,107C 'attack':52B 'bodi':139C 'bound':101C 'buffer':36B,149C 'byte':69B,126C,143C,147C 'client':9A 'control':54B 'copi':67B,124C,131C 'corrupt':6A,62B,165C 'craft':2A 'cve':11A,14A 'd':45B,134C 'driver':23B,60B,159C 'entri':96C 'escap':4A,28B,49B,78C,91C,109C,138C 'expos':160C 'fix':33B,94C 'fixed-s':32B 'fn':44B,90C 'form':50B 'forward':153C 'includ':43B 'initi':105C 'mani':112C 'memori':7A,164C 'odbc':3A,17B,27B,77C 'offset':87C 'one':142C 'overflow':114C 'packag':18B 'parser':25B,75C 'past':31B,144C 'postgresql':19B 'process':64B,162C 'psqlodbc':1A,20B,22B,74C,168C 'queri':72B,129C 'read':39B 'refer':119C 'sent':57B 'sequenc':5A,29B,79C 'size':34B 'sql':41B,55B,82C,155C 'stack':35B,65B,97C,116C,148C 'text':42B,56B,83C,156C 'ts':47B,136C 'unsuppli':122C 'untrust':154C 'version':166C 'without':99C 'write':30B,84C,141C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted SQL text through the psqlODBC driver are exposed to memory corruption in their process. Systems where only trusted, fixed queries reach the driver are less exposed. unknown for exact trigger conditions beyond the description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","odbc","package","postgresql","psqlodbc"],"first_public_at":"2026-11-02T19:18:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120061","severity":null,"published_at":"2026-11-02T19:18:03+00:00","modified_at":"2026-11-02T19:18:03+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","fetched_at":"2026-11-02T19:24:39+00:00","note":null}],"documents":[{"id":53472,"url":"https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-hfm6-qfx8-v4xq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}