Vulnerability · Published Nov 2, 2026 · Assigned by PostgreSQL
CVE-2026-120061psqlODBC ODBC escape parser stack buffer overflow
High 7.5
In plain English
A high-severity stack buffer overflow in psqlODBC from PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | psqlodbc | no fix listed | DEBIAN-CVE-2026-120061 |
| Debian:13 | psqlodbc | no fix listed | DEBIAN-CVE-2026-120061 |
| Debian:14 | psqlodbc | 1:18.00.0006-1 | DEBIAN-CVE-2026-120061 |
| Ubuntu:22.04:LTS | psqlodbc | no fix listed | UBUNTU-CVE-2026-120061 |
| Ubuntu:24.04:LTS | psqlodbc | no fix listed | UBUNTU-CVE-2026-120061 |
| Ubuntu:26.04:LTS | psqlodbc | no fix listed | UBUNTU-CVE-2026-120061 |
| Ubuntu:26.10 | psqlodbc | no fix listed | UBUNTU-CVE-2026-120061 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PostgreSQL | psqlODBC | 0 – before 18.00.0006 |
Weakness: CWE-121, CWE-193, CWE-457 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H