Buffer Overflow Vulnerability in psqlODBC by PostgreSQL

CVE-2026-120067

What is CVE-2026-120067?

A vulnerability exists in psqlODBC that can lead to a buffer overflow due to improper handling of data with updatable cursors. When a query is executed that includes hidden ctid and oid columns, the driver does not adequately check the size of the incoming data against the buffer limits. This can result in more than 32 bytes of data being written beyond allocated buffer space, potentially allowing unauthorized users or untrusted servers to execute malicious code. Affected versions are those prior to psqlODBC 18.00.0006.

References