Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120067— psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors

Quick assessment

Affected
PostgreSQL psqlODBC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

对于默认启用的可更新游标，psqlODBC 会在查询中隐式添加 列，若表包含 OID，还会添加 列。该驱动在复制每个值时，直接使用服务器返回的长度写入一个 32 字节的栈缓冲区，而未将该长度与缓冲区大小进行校验；因此，当值长度达到或超过 32 字节时，就会发生缓冲区溢出，将数据写入缓冲区之外。在当前 SSL 配置下，任何不受信任的服务器均可发送此类值；此外，任何能够创建包含名为 的自定义列视图的数据库用户，也可通过应用程序使用可更新游标读取该视图来触发此问题。在启用 的构建版本中，程序会直接终止；而在其他构建版本中

CVSS 5.9 · Medium EPSS 0.35% · P28

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
PostgreSQL psqlODBC < 18.00.0006 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120067

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
Source: CVE Program / CVE List V5
Vulnerability Description
For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with _FORTIFY_SOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PostgreSQL psqlODBC 0 ~ 18.00.0006 -

II. Public POCs for CVE-2026-120067

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120067

请登录查看更多情报信息。

Other References for CVE-2026-120067 (1)

Same Patch Batch · PostgreSQL · 2026-11-02 · 11 CVEs total

CVE-2026-120062 7.5 HIGH psqlODBC SQL injection through SQLSpecialColumns table and schema names
CVE-2026-120061 7.5 HIGH psqlODBC ODBC escape parser stack buffer overflow
CVE-2026-120058 7.5 HIGH psqlODBC row cache overflow when a later FETCH changes the column count
CVE-2026-120057 7.5 HIGH psqlODBC large-object read overflows the application buffer
CVE-2026-120064 7.5 HIGH psqlODBC does not validate column numbers and row indexes in binding and descriptor functi
CVE-2026-120065 7.1 HIGH psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
CVE-2026-120059 6.8 MEDIUM psqlODBC uses a server-supplied column name as a format string
CVE-2026-120060 5.9 MEDIUM psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120063 5.9 MEDIUM psqlODBC stack buffer overflow when quoting long schema and table names
CVE-2026-120066 5.3 MEDIUM psqlODBC log files are created with default permissions at a predictable path and follow s

IV. Related Vulnerabilities

Same product: psqlODBC
Same vendor: PostgreSQL
Same weakness: CWE-121