---
id: "CVE-2026-120064"
kind: "vulnerability"
aliases: ["CVE-2026-120064"]
title: "psqlODBC: unchecked column and row numbers allow out-of-bounds memory writes"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["odbc", "package", "postgresql", "psqlodbc"]
not_affected_if: ["fixed-column-indexes", "no-untrusted-input"]
published_at: "2026-11-02T19:18:03+00:00"
first_seen_at: "2026-11-02T19:24:40+00:00"
updated_at: "2026-11-02T19:26:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120064", "first_seen_at": "2026-11-02T19:24:40+00:00"}]
---

# psqlODBC: unchecked column and row numbers allow out-of-bounds memory writes

Several psqlODBC driver functions use an application-supplied column number or row index as an array index without checking it. An application that passes untrusted values into these calls can have its process read and write memory out of bounds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed psqlODBC version against the fixed release in the sources.
- Look for applications that pass untrusted input into SQLBindCol, SQLColAttribute or SQLSetPos through the psqlODBC driver.

## Fix

- psqlODBC: move to `18.00.0006` or later.

## Timeline

- 2026-11-02T19:24:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120064

## Documents

- [advisory] Vendor advisory: github.com https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-7pq2-q7mj-ph8c

## From the sources

Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_