Out-of-Bounds Read and Crash Vulnerability in psqlODBC from PostgreSQL

CVE-2026-120060

What is CVE-2026-120060?

The psqlODBC driver for PostgreSQL contains vulnerabilities that arise from insufficient validation of server-supplied data. Specifically, in functions such as SQLBulkOperations and SQLStatistics, the driver trusts server-supplied counts that can lead to underflows or allow iteration beyond allocated memory bounds. Additionally, issues with Bytea octal decoding can result in reading beyond the end of truncated escape sequences. Such weaknesses can be exploited by a malicious server, potentially crashing the client application or causing it to access out-of-bounds memory locations, which may lead to further exploitation depending on the application's handling of the memory.

References