---
id: "CVE-2026-120067"
kind: "vulnerability"
aliases: ["CVE-2026-120067"]
title: "psqlODBC: stack overflow in updatable cursor ctid handling lets a server write memory"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux", "odbc", "package", "postgresql", "psqlodbc", "windows"]
not_affected_if: ["no-updatable-cursors", "trusted-servers-only"]
published_at: "2026-11-02T19:18:04+00:00"
first_seen_at: "2026-11-02T19:24:40+00:00"
updated_at: "2026-11-02T19:26:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120067", "first_seen_at": "2026-11-02T19:24:40+00:00"}]
---

# psqlODBC: stack overflow in updatable cursor ctid handling lets a server write memory

psqlODBC is the PostgreSQL ODBC driver. A malicious or untrusted database server, or a database user who can create a view with a column named ctid, can send an oversized value that overflows a 32-byte stack buffer in the driver.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed psqlODBC driver version and confirm whether it is below `18.00.0006`
- Check whether applications use updatable cursors (enabled by default)
- Check whether connections go to servers that are not fully trusted

## Fix

- psqlODBC `18.00.0006` or later

## Timeline

- 2026-11-02T19:24:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120067

## Documents

- [advisory] Vendor advisory: github.com https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-3r96-h2q4-6pxh

## From the sources

For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with _FORTIFY_SOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_