CVE-2026-120064
Awaiting Analysis Awaiting Analysis - Queue

psqlODBC Array Index Validation Flaw

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: PostgreSQL

Description
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120064

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PostgreSQL psqlODBC 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves psqlODBC functions using unvalidated user-supplied column or row numbers as array indices. This can lead to out-of-bounds memory access, potentially allowing attackers to read or write arbitrary memory. The issue affects SQLBindCol, SQLColAttribute, and SQLSetPos functions when handling large or negative indices.

Detection Guidance

This vulnerability can be detected by checking the version of psqlODBC installed on your system. If the version is below 18.00.0006, the system is vulnerable. Use commands like 'psqlodbc --version' or check package managers (e.g., 'dpkg -l | grep psqlodbc' for Debian-based systems).

Additionally, review application logs for unusual memory access patterns or crashes, which may indicate out-of-bounds reads/writes due to untrusted column or row numbers.

Impact Analysis

An attacker could exploit this to crash the application, leak sensitive data, or execute arbitrary code with the privileges of the user running psqlODBC. This is especially dangerous if the application processes untrusted input, such as web forms or APIs.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations, fines, or reputational damage if exploited.

Mitigation Strategies

Upgrade psqlODBC to version 18.00.0006 or later immediately. This version addresses the array index validation issues. Follow your distribution's update procedures or download the latest version from the official PostgreSQL repository.

Review applications using psqlODBC to ensure they do not pass untrusted column or row numbers. Validate all inputs to prevent negative or excessively large indices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120064. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...