CVE-2026-120060 in psqlODBC
Summary
by MITRE • 11/02/2026
psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability in psqlODBC stems from insufficient validation and sanitization of data received directly from a PostgreSQL server, specifically regarding integer counts and byte lengths within the ODBC driver's processing logic. This lack of rigorous boundary checking creates multiple distinct attack vectors that can lead to memory corruption, denial of service, or unauthorized information disclosure. The core issue is rooted in the assumption that metadata provided by the database server will always be well-formed and consistent with client-side expectations, a trust model that becomes dangerous when interacting with untrusted or compromised servers.
One critical flaw exists within the SQLBulkOperations function, where the driver utilizes a row count supplied by the server to perform size subtraction calculations for buffer management. If an attacker controls this server-supplied value, they can manipulate it to be larger than the actual allocated memory space. This results in an integer underflow during the calculation of remaining buffer sizes or offsets. Such arithmetic errors typically lead to negative indices being used as positive unsigned integers, causing subsequent write operations to occur at incorrect memory addresses. This scenario is a classic example of CWE-190 Integer Overflow or Wraparound and can potentially allow for arbitrary code execution if the corrupted memory region contains executable content or critical control data structures.
A second vulnerability involves the SQLStatistics function, which processes index key information from the server. The driver iterates through keys based on a count provided by the database without enforcing an upper bound relative to the fixed-size storage buffers allocated locally. When the server reports a number of keys that exceeds the capacity of these static arrays or buffers, the iteration loop writes beyond the allocated memory boundaries. This out-of-bounds write constitutes CWE-787 Out-of-Bounds Write and can corrupt adjacent heap metadata or other application data structures. In severe cases, this corruption can destabilize the process state, leading to crashes or providing an avenue for exploiting more complex memory management vulnerabilities within the host application using psqlODBC.
The third area of concern lies in the handling of Bytea octal decoding sequences. The driver fails to properly validate the length and termination of escape sequences when parsing binary data transmitted by the server. Specifically, during the decoding process, the implementation may read up to two bytes past the end of a truncated or malformed escape sequence. This behavior represents CWE-125 Out-of-Bounds Read and allows an attacker with control over the server's output to leak sensitive information from adjacent memory regions into the client application. Such data leakage can expose internal state variables, cryptographic keys, or other confidential data stored in memory near the buffer being processed.
The operational impact of these vulnerabilities is significant for any organization relying on psqlODBC to connect to PostgreSQL databases that are not fully trusted. If a database server has been compromised by an attacker, it can exploit these flaws to crash the client application, resulting in a Denial of Service condition categorized under MITRE ATT&CK technique T1499 Endpoint Denial of Service. Alternatively, if the underlying memory corruption is exploitable with precise control over heap layout and data values, it could lead to Remote Code Execution on the client machine. This transforms a simple database connection into a potential entry point for lateral movement or privilege escalation within an enterprise network environment.
Mitigation strategies must prioritize immediate patching of all affected systems. Organizations should upgrade psqlODBC to version 18.00.0006 or later, where these boundary checks and input validations have been corrected. Until the update is applied, administrators should enforce strict SSL/TLS configurations that require mutual authentication or certificate pinning against known malicious servers. This ensures that only trusted database instances can establish connections with clients running vulnerable versions of the driver. Additionally, deploying network-level intrusion detection systems to monitor for anomalous SQL traffic patterns involving bulk operations or unusual binary data transfers may help detect exploitation attempts in real-time before they cause significant damage.