Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120059— psqlODBC uses a server-supplied column name as a format string

Quick assessment

Affected
PostgreSQL psqlODBC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

对于没有 OIDs 的表，若其包含一个自增的 int4 列，且该表通过可更新游标进行访问，psqlODBC 驱动程序会将服务器报告该列的列名直接放入一个 printf 风格的格式字符串中。随后，在构建其定位式 SELECT、UPDATE 和 DELETE 语句的 WHERE 子句时，驱动程序会使用一个参数来扩展该字符串。如果列名中包含格式说明符（format directives），将导致驱动程序读取不相关的内存区域，从而引发应用程序崩溃，或将客户端内存内容复制到发送给服务器的查询文本中。此类列名可能来自当前 SS

CVSS 6.8 · Medium EPSS 0.26% · P18

Affected Version Matrix 1

VendorProduct Version RangeStatus
PostgreSQL psqlODBC < 18.00.0006 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120059

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
psqlODBC uses a server-supplied column name as a format string
Source: CVE Program / CVE List V5
Vulnerability Description
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部控制的格式字符串
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PostgreSQL psqlODBC 0 ~ 18.00.0006 -

II. Public POCs for CVE-2026-120059

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120059

请登录查看更多情报信息。

Other References for CVE-2026-120059 (1)

Same Patch Batch · PostgreSQL · 2026-11-02 · 11 CVEs total

CVE-2026-120062 7.5 HIGH psqlODBC SQL injection through SQLSpecialColumns table and schema names
CVE-2026-120061 7.5 HIGH psqlODBC ODBC escape parser stack buffer overflow
CVE-2026-120058 7.5 HIGH psqlODBC row cache overflow when a later FETCH changes the column count
CVE-2026-120057 7.5 HIGH psqlODBC large-object read overflows the application buffer
CVE-2026-120064 7.5 HIGH psqlODBC does not validate column numbers and row indexes in binding and descriptor functi
CVE-2026-120065 7.1 HIGH psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
CVE-2026-120060 5.9 MEDIUM psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120067 5.9 MEDIUM psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
CVE-2026-120063 5.9 MEDIUM psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120066 5.3 MEDIUM psqlODBC log files are created with default permissions at a predictable path and follow s

IV. Related Vulnerabilities

Same product: psqlODBC
Same vendor: PostgreSQL
Same weakness: CWE-134