CVE-2026-120067 in psqlODBC
Summary
by MITRE • 11/02/2026
For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with _FORTIFY_SOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability in question resides within the psqlODBC driver, specifically affecting its handling of updatable cursors which are enabled by default configuration settings. This component is responsible for facilitating database interactions between applications and PostgreSQL databases via the Open Database Connectivity standard. The core technical flaw involves a classic stack-based buffer overflow condition triggered during the processing of cursor data. When an application utilizes an updatable cursor, psqlODBC automatically modifies the underlying SQL query to include hidden columns named ctid and, in cases where tables possess Object Identifiers (OIDs), also includes oid columns. These additions are necessary for the driver to manage row-level updates efficiently by uniquely identifying rows within the database table.
The critical failure occurs when the driver retrieves values from these added columns and attempts to store them into a fixed-size stack buffer that is exactly thirty-two bytes in length. The implementation flaw lies in the fact that the code copies each value using the byte length provided directly by the server without performing any validation against the actual capacity of the destination buffer. Consequently, if the data returned from the database for either the ctid or oid column contains a string or binary payload of thirty-two bytes or more, the copy operation will write past the end of the allocated stack memory. This out-of-bounds write corrupts adjacent memory locations on the call stack, potentially overwriting return addresses, saved frame pointers, or other critical control data structures.
The exploitability of this vulnerability is contingent upon two primary conditions related to trust and access rights. First, the database server must not be fully trusted under current SSL settings, allowing a malicious actor positioned in a man-in-the-middle role or an untrusted server instance to inject oversized values into the response stream. Second, any authenticated database user who possesses the privilege to create views can exploit this flaw locally within their own schema. By creating a view that defines its own column named ctid and populating it with data exceeding thirty-two bytes, the application reading from this view via an updatable cursor will trigger the buffer overflow upon retrieval of those rows. This effectively allows any user with CREATE VIEW privileges to execute arbitrary code or cause denial of service by crashing the process hosting the psqlODBC driver.
The operational impact is severe and varies based on how the software was compiled during its build phase. For builds that include _FORTIFY_SOURCE, a common security hardening feature in modern compilers, the overflow will likely be detected at runtime, resulting in an immediate abort or termination of the application process to prevent further exploitation. This manifests as a denial-of-service condition where the affected service becomes unavailable until restarted. However for standard builds lacking this fortification, the vulnerability allows for arbitrary code execution. An attacker could leverage the stack memory corruption to inject and execute shellcode, gain elevated privileges if the driver runs with higher permissions, or manipulate application logic by altering control flow through overwritten return addresses.
This issue is classified under CWE-121, which denotes a stack-based buffer overflow, indicating that the root cause is an improper limitation on input size relative to the allocated memory space. In terms of attack vectors and techniques, this vulnerability aligns with ATT&CK technique T1059, specifically Command Line Interface execution if shellcode injection leads to command execution, or more broadly under privilege escalation paths depending on the context in which psqlODBC operates within the target environment. The lack of bounds checking represents a fundamental violation of secure coding principles regarding input validation and memory safety.
Mitigation strategies focus primarily on updating the affected software components. Organizations relying on versions prior to psqlODBC 18.00.0006 must upgrade immediately to version 18.00.0006 or later, where this buffer overflow has been remediated through proper length validation before memory copy operations. In environments where immediate patching is not feasible, temporary mitigations include restricting database privileges so that untrusted users cannot create views with columns named ctid, thereby preventing the trigger condition from being met by malicious actors. Additionally ensuring strict SSL configurations and trusting only verified database servers can reduce the risk of exploitation via network-based injection attacks. Regular security audits focusing on ODBC driver usage patterns and input validation practices are recommended to prevent similar vulnerabilities in related components.