Stack Buffer Overflow in psqlODBC Affects PostgreSQL Driver

CVE-2026-120063

What is CVE-2026-120063?

A vulnerability exists in the PostgreSQL psqlODBC driver due to insufficient length checking when quoting schema or table names into a 128-byte stack buffer. This flaw allows for writing beyond the intended buffer space, potentially leading to stack corruption. The vulnerability is triggered by untrusted SQL text forwarded to the driver. Specifically, the issue arises with the parsing of the last INSERT statement during an @@IDENTITY rewrite, where excessively long column names can result in writing an additional byte past the buffer limit. Ensure that psqlODBC version 18.00.0006 or later is in use to mitigate the risks associated with this vulnerability.

References