CVE-2026-120058
High
Description
psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.
SeverityHigh
CVSS7.5
Exploit probability—
Product
psqlODBC
PublishedNov 2, 2026
First seenNov 4, 2026
Weakness typeCWE-787Out-of-bounds writeCWE-191CWE-191
How to fix
Update
- PostgreSQL psqlODBC18.00.0006 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PostgreSQL psqlODBC | v < 18.00.0006 | 18.00.0006 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.