redhat/postgresql-odbc vulnerabilities

Latest redhat/postgresql-odbc CVEs

Newest publication first

1. CVE-2026-120067 psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors

   Published 2026-11-02

   Medium·CVSS 5.9 EPSS 0.35%

   For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 byt...

2. CVE-2026-120066 psqlODBC log files are created with default permissions at a predictable path and follow symbolic links

   Published 2026-11-02

   Medium·CVSS 5.3 EPSS 0.11%

   On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read qu...

3. CVE-2026-120065 psqlODBC does not escape a server-supplied column name in its updatable-cursor queries

   Published 2026-11-02

   High·CVSS 7.1 EPSS 0.29%

   For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELE...

4. CVE-2026-120062 psqlODBC SQL injection through SQLSpecialColumns table and schema names

   Published 2026-11-02

   High·CVSS 7.5 EPSS 0.36%

   SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbi...

5. CVE-2026-120061 psqlODBC ODBC escape parser stack buffer overflow

   Published 2026-11-02

   High·CVSS 7.5 EPSS 0.34%

   The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an uns...

6. CVE-2026-120059 psqlODBC uses a server-supplied column name as a format string

   Published 2026-11-02

   Medium·CVSS 6.8 EPSS 0.26%

   For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its posit...

7. CVE-2026-120058 psqlODBC row cache overflow when a later FETCH changes the column count

   Published 2026-11-02

   High·CVSS 7.5 EPSS 0.26%

   psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the dri...

8. CVE-2026-120057 psqlODBC large-object read overflows the application buffer

   Published 2026-11-02

   High·CVSS 7.5 EPSS 0.24%

   psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer hol...

9. CVE-2026-109448 psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters

   Published 2026-10-12

   Medium·CVSS 5.9 EPSS 0.22%

   Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.