PostgreSQL psqlODBC 18.00.0005 format string

Summaryinfo

A vulnerability labeled as critical has been found in PostgreSQL psqlODBC. The impacted element is an unknown function. Executing a manipulation can lead to format string. The identification of this vulnerability is CVE-2026-120059. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in PostgreSQL psqlODBC. It has been declared as critical. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a format string vulnerability. The CWE definition for the vulnerability is CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-120059 since 10/30/2026. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 18.00.0006 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• PostgreSQL

Name

• psqlODBC

Version

• 18.00.0005

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion