Vulnerability in PostgreSQL psqlODBC

[ Description ]Official description

psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4307

  PostgreSQL ODBC Treiber: Multiple vulnerabilities allow data manipulation Translated from German

  CVE-2026-120057CVE-2026-120061
• CERT-FR3 Nov 2026CERTFR-2026-AVI-1445

  Multiple vulnerabilities in PostgreSQL Translated from French

  Multiple vulnerabilities have been discovered in PostgreSQL. They allow an attacker to cause SQL injection (SQLi), a security policy bypass and a security problem not specified by the vendor.

  CVE-2026-120066CVE-2026-120064CVE-2026-120067+8 more CVEs

[ References ]References

• github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-qhmr-5339-q33r