CVE-2026-120057
High
Description
psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.
SeverityHigh
CVSS7.5
Exploit probability—
Product
psqlODBC
PublishedNov 2, 2026
First seenNov 4, 2026
Weakness typeCWE-120CWE-120
How to fix
Update
- PostgreSQL psqlODBC18.00.0006 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PostgreSQL psqlODBC | v < 18.00.0006 | 18.00.0006 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.