Vulnerability in psqlODBC Affected by Improper Handling of Double Quotes

CVE-2026-120065

What is CVE-2026-120065?

The psqlODBC driver contains a vulnerability where it improperly handles double quotes in column names when dealing with updatable cursors on tables without OIDs. Specifically, it uses the name of an auto-increment int4 column to identify rows but does not handle cases where the name includes double quotes. This oversight can lead to modified SQL queries that may allow attackers to manipulate which rows are affected by UPDATE or DELETE statements. As a result, any database user with the ability to create a table that the application accesses can exploit this flaw, potentially compromising application security by executing unauthorized actions.

References