psqlODBC CVE-2026-109448

Exploitation requires a calling application that uses psqlODBC and binds more than 32768 parameters on a single statement via SQLBindParameter - specifically where the parameter count is derived from untrusted input, such as an attacker-controlled 'IN (?, ?, ...)' list. The attacker must be able to drive the bound-parameter count to 32769 (binding #32768 wraps the signed 16-bit count to -32768; #32769 triggers the out-of-bounds write). Limiting factors: this is not a default-configuration remote flaw against the driver itself - the host application must expose the parameter count to attacker influence, applications that cap or fix their parameter counts are not exposed, and only psqlODBC versions before 18.00.0005 are affected. No authentication to the driver is required (PR:N), but the practical precondition of a vulnerable application pattern is why attack complexity is high.

This is a medium-severity (CVSS 5.9) availability-only flaw, and the signals consistently point to real-but-limited risk rather than a top priority. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) shows network reachability with no authentication, but high attack complexity and impact restricted to availability (C:N/I:N) - consistent with CWE-190 integer overflow causing heap corruption and a crash rather than code execution. The vendor (PostgreSQL) scopes the outcome to crash or corrupted-heap state, not confirmed arbitrary code execution, so treating this as a DoS/stability issue is appropriate. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AC:H rating is well-founded because exploitation is not universal: it requires a calling application that builds parameter lists from untrusted input (e.g., an IN (?, ?, ...) list) and lets an attacker drive the bound-parameter count past 32768. No conflicting signals were found; the main gap is that heap-corruption bugs can sometimes escalate beyond DoS, but nothing in the provided data supports an integrity/confidentiality impact, so the A:H-only scoring is accepted.

An application uses psqlODBC and constructs a parameterized query such as 'col IN (?, ?, ...)' where the number of placeholders is derived from untrusted, attacker-influenced input. The attacker submits input large enough to make the application bind parameter number 32769, wrapping the signed 16-bit binding count to a negative value; psqlODBC then writes roughly 2.5 MB of zeros starting about 1.25 MB before the binding array, corrupting the heap and crashing the process. No public exploit code was identified at time of analysis, and exploitation hinges on the host application exposing the parameter count to attacker control.