Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120060— psqlODBC does not validate server-supplied counts and lengths

Quick assessment

Affected
PostgreSQL psqlODBC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

psqlODBC 在三个位置信任服务器数据中的计数和长度信息： 1. SQLBulkOperations：使用服务器提供的行计数进行尺寸减法运算，可能导致整数下溢。 2. SQLStatistics：使用服务器提供的键计数迭代索引键，但未将其限制在固定存储范围内。 3. Bytea 八进制解码：在截断的转义序列后，最多读取两个额外字节。 若当前 SSL 设置下无法信任该服务器，则可能引发客户端崩溃或导致其越界读取。受影响的版本为 psqlODBC 18.00.0006 之前的所有版本。

CVSS 5.9 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
PostgreSQL psqlODBC < 18.00.0006 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120060

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
psqlODBC does not validate server-supplied counts and lengths
Source: CVE Program / CVE List V5
Vulnerability Description
psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PostgreSQL psqlODBC 0 ~ 18.00.0006 -

II. Public POCs for CVE-2026-120060

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120060

请登录查看更多情报信息。

Other References for CVE-2026-120060 (1)

Same Patch Batch · PostgreSQL · 2026-11-02 · 11 CVEs total

CVE-2026-120062 7.5 HIGH psqlODBC SQL injection through SQLSpecialColumns table and schema names
CVE-2026-120061 7.5 HIGH psqlODBC ODBC escape parser stack buffer overflow
CVE-2026-120058 7.5 HIGH psqlODBC row cache overflow when a later FETCH changes the column count
CVE-2026-120057 7.5 HIGH psqlODBC large-object read overflows the application buffer
CVE-2026-120064 7.5 HIGH psqlODBC does not validate column numbers and row indexes in binding and descriptor functi
CVE-2026-120065 7.1 HIGH psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
CVE-2026-120059 6.8 MEDIUM psqlODBC uses a server-supplied column name as a format string
CVE-2026-120067 5.9 MEDIUM psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
CVE-2026-120063 5.9 MEDIUM psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120066 5.3 MEDIUM psqlODBC log files are created with default permissions at a predictable path and follow s

IV. Related Vulnerabilities

Same product: psqlODBC
Same vendor: PostgreSQL
Same weakness: CWE-125