Vulnerability in PostgreSQL psqlODBC

[ Description ]Official description

The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4307

  PostgreSQL ODBC Treiber: Multiple vulnerabilities allow data manipulation Translated from German

  CVE-2026-120057CVE-2026-120061
• CERT-FR3 Nov 2026CERTFR-2026-AVI-1445

  Multiple vulnerabilities in PostgreSQL Translated from French

  Multiple vulnerabilities have been discovered in PostgreSQL. They allow an attacker to cause SQL injection (SQLi), a security policy bypass and a security problem not specified by the vendor.

  CVE-2026-120066CVE-2026-120064CVE-2026-120067+8 more CVEs

[ References ]References

• github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-hfm6-qfx8-v4xq