Out-of-Bounds Read and Write Vulnerability in psqlODBC by PostgreSQL

CVE-2026-120064

What is CVE-2026-120064?

The psqlODBC driver is vulnerable to out-of-bounds reads and writes due to several entry points that improperly validate application-supplied column numbers and row indices. When using SQLBindCol, a column number exceeding 32767 can result in negative wrapping of the binding count, leading to unsafe memory access during subsequent operations. Similarly, negative indexes may arise during SQLColAttribute calls if large column numbers are employed. Additionally, SQLSetPos does not properly enforce row size limits, allowing untrusted applications to conduct arbitrary memory access via invalid column or row identifiers, posing a significant security risk.

References