Integer Wraparound Vulnerability in psqlODBC by PostgreSQL

CVE-2026-109448

What is CVE-2026-109448?

The integer wraparound vulnerability in psqlODBC's SQLBindParameter function allows an attacker to manipulate the number of parameters bound in a statement, leading to potential heap memory corruption. By exceeding the allowed parameter count, specifically binding parameter numbers that trigger the wraparound effect, an attacker can cause the application to write incorrect data to memory. This behavior, particularly when applications accept untrusted input for parameter lists, can result in severe application instability or crashes, exposing critical systems to further risks.

References