Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120064— psqlODBC does not validate column numbers and row indexes in binding and descriptor functions

Quick assessment

Affected
PostgreSQL psqlODBC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

多个 psqlODBC 入口点在使用应用程序提供的列号或行索引作为数组索引时，未对其进行验证。当 SQLBindCol 使用的列号大于 32767 时，绑定计数会回绕为负数，导致后续复制操作越界访问数组。若应用程序行描述符中的 SQL_DESC_COUNT 为负数，则会在负索引处解除列绑定。SQLColAttribute 在接收到极大的列号时，会使用负索引。SQLSetPos(SQL_ADD) 未将行号与行集大小进行比对。任何将不可信的列号或行号转发的应用程序，都会使其进程面临数组越界读写风险。受影响的版本为 ps

CVSS 7.5 · High EPSS 0.34% · P28

Affected Version Matrix 1

VendorProduct Version RangeStatus
PostgreSQL psqlODBC < 18.00.0006 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120064

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
psqlODBC does not validate column numbers and row indexes in binding and descriptor functions
Source: CVE Program / CVE List V5
Vulnerability Description
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数组索引的验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PostgreSQL psqlODBC 0 ~ 18.00.0006 -

II. Public POCs for CVE-2026-120064

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120064

请登录查看更多情报信息。

Other References for CVE-2026-120064 (1)

Same Patch Batch · PostgreSQL · 2026-11-02 · 11 CVEs total

CVE-2026-120062 7.5 HIGH psqlODBC SQL injection through SQLSpecialColumns table and schema names
CVE-2026-120061 7.5 HIGH psqlODBC ODBC escape parser stack buffer overflow
CVE-2026-120058 7.5 HIGH psqlODBC row cache overflow when a later FETCH changes the column count
CVE-2026-120057 7.5 HIGH psqlODBC large-object read overflows the application buffer
CVE-2026-120065 7.1 HIGH psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
CVE-2026-120059 6.8 MEDIUM psqlODBC uses a server-supplied column name as a format string
CVE-2026-120060 5.9 MEDIUM psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120067 5.9 MEDIUM psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
CVE-2026-120063 5.9 MEDIUM psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120066 5.3 MEDIUM psqlODBC log files are created with default permissions at a predictable path and follow s

IV. Related Vulnerabilities

Same product: psqlODBC
Same vendor: PostgreSQL
Same weakness: CWE-129