CVE-2026-120063 in psqlODBC
Summary
by MITRE • 11/02/2026
When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in psqlODBC represents a classic buffer overflow condition rooted in insufficient bounds checking during string handling operations. Specifically, when the driver processes schema or table names for inclusion within SQL statements, it utilizes a fixed-size stack buffer of 128 bytes to construct these identifiers. The core technical flaw lies in the logic used to validate input length prior to copying data into this buffer. While the implementation attempts to prevent overflow by checking if the name fits, the calculation fails to account correctly for the termination characters or quote delimiters that must be appended after the primary string content. This miscalculation allows an attacker who controls the SQL text sent to the driver to write up to two bytes beyond the allocated stack memory boundary when handling long identifiers.
The attack surface is primarily defined by how psqlODBC parses and rewrites SQL statements on behalf of the host application. The vulnerability manifests in two distinct operational contexts within the driver's execution flow. First, during the parsing phase where the driver analyzes a statement to describe its columns, it extracts table names from the provided SQL text. If an untrusted user supplies a sufficiently long table name that triggers this path, the buffer overflow occurs as the driver attempts to quote and store the identifier. Second, the vulnerability is present in the logic used for rewriting SELECT @@IDENTITY statements, which are commonly employed by applications to retrieve the last inserted identity value after an INSERT operation. In this scenario, the length check again permits writing two bytes past the end of the 128-byte buffer when processing long table names from the SQL text.
A secondary vector exists within the handling of server-sent metadata during the @@IDENTITY rewrite process. Here, a column name returned by the database server can cause an overflow of one byte past the buffer boundary. Although this specific instance results in only a single byte of out-of-bounds write, it still constitutes a memory safety violation that contributes to the overall instability and potential exploitability of the driver when interacting with untrusted or compromised data sources. The bytes written beyond the buffer limits are consistently identified as a double quote character followed by a null terminator, which may alter adjacent stack variables depending on their alignment and usage within the function's local scope.
The operational impact of this vulnerability is significant for any application that forwards SQL text to psqlODBC without rigorous sanitization or validation of identifier lengths. Because the overflow occurs on the process stack, successful exploitation can lead to stack corruption, which may result in application crashes, denial of service, or potentially arbitrary code execution if an attacker can precisely control the data written past the buffer and manipulate return addresses or function pointers located nearby on the stack. This risk is particularly acute for web applications or services that accept dynamic SQL input from end-users, as they effectively expose their underlying process memory to corruption through this driver interface.
From a classification perspective, this vulnerability aligns with CWE-121, which denotes a stack-based buffer overflow caused by copying data without proper bounds checking. It also relates to CWE-787, an out-of-bounds write that occurs due to incorrect calculation of array indices or string lengths. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques associated with initial exploitation and privilege escalation through memory corruption, specifically falling under categories related to buffer overflows such as T1203 if leveraged for code execution. The vulnerability affects versions of psqlODBC prior to release 18.00.0006, which introduced the necessary corrections to length validation logic.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. Organizations relying on affected versions should upgrade immediately to version 18.00.0006 or later, where the bounds checking mechanisms have been corrected to properly account for all characters added during string construction, including quotes and null terminators. For environments where upgrading is not immediately feasible, implementing strict input validation at the application layer is critical. Developers should enforce maximum length limits on schema and table names before passing them to the ODBC driver, ensuring that no identifier exceeds a safe threshold well below the 128-byte buffer limit. Additionally, enabling compiler protections such as stack canaries or Address Sanitizer during development phases can help detect similar issues in future code revisions by identifying out-of-bounds writes early in the software lifecycle.