Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120061— psqlODBC ODBC escape parser stack buffer overflow

Quick assessment

Affected
PostgreSQL psqlODBC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

psqlODBC 驱动程序中用于解析应用 SQL 文本里 ODBC 转义序列的解析器，会将 转义序列的参数偏移量写入一个固定长度为 16 的栈数组，且未进行边界检查，也未对该数组进行初始化。当转义序列包含过多参数时，会导致栈溢出；而引用未提供的参数时，会将任意字节复制到查询中。此外，复制 、 、 或 转义序列的主体内容时，也会向一个 128 字节的栈缓冲区之后多写入一个字节。若应用程序将不可信的 SQL 文本转发给该驱动程序，其进程将面临内存破坏的风险。受影响版本为 psqlODBC 18.00.0006 之前的所

CVSS 7.5 · High EPSS 0.34% · P28

Affected Version Matrix 1

VendorProduct Version RangeStatus
PostgreSQL psqlODBC < 18.00.0006 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120061

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
psqlODBC ODBC escape parser stack buffer overflow
Source: CVE Program / CVE List V5
Vulnerability Description
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PostgreSQL psqlODBC 0 ~ 18.00.0006 -

II. Public POCs for CVE-2026-120061

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120061

请登录查看更多情报信息。

Other References for CVE-2026-120061 (1)

Same Patch Batch · PostgreSQL · 2026-11-02 · 11 CVEs total

CVE-2026-120062 7.5 HIGH psqlODBC SQL injection through SQLSpecialColumns table and schema names
CVE-2026-120058 7.5 HIGH psqlODBC row cache overflow when a later FETCH changes the column count
CVE-2026-120057 7.5 HIGH psqlODBC large-object read overflows the application buffer
CVE-2026-120064 7.5 HIGH psqlODBC does not validate column numbers and row indexes in binding and descriptor functi
CVE-2026-120065 7.1 HIGH psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
CVE-2026-120059 6.8 MEDIUM psqlODBC uses a server-supplied column name as a format string
CVE-2026-120060 5.9 MEDIUM psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120067 5.9 MEDIUM psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
CVE-2026-120063 5.9 MEDIUM psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120066 5.3 MEDIUM psqlODBC log files are created with default permissions at a predictable path and follow s

IV. Related Vulnerabilities

Same product: psqlODBC
Same vendor: PostgreSQL
Same weakness: CWE-121