psqlODBC CVE-2026-120059

Exploitation requires a specific, non-default alignment of conditions drawn directly from the description: (1) the application must open an UPDATABLE cursor over (2) a table WITHOUT OIDs that (3) has an auto-increment int4 column, and (4) that column's name - as reported by the server - must contain printf format directives. The malicious name must originate either from a PostgreSQL server not trusted under the client's current SSL settings, or from any database user with privileges to create a table the application subsequently reads. Limiting factors: the CVSS vector's UI:R and AC:H reflect that the vulnerable code path only runs when the application performs positioned SELECT/UPDATE/DELETE over such a cursor, and the attacker must influence server-reported column naming - so default, read-only, or OID-bearing usage is not affected.

This is a moderate, not emergency, priority. The vendor-supplied CVSS of 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H) reflects a network-reachable but high-complexity, interaction-dependent issue: the driver must run an updatable cursor over a table that has no OIDs and an auto-increment int4 column, and the triggering column name must contain printf format directives. The vuln.today decision label is 'this_month' (not act_now or emergency), which is consistent with a real but non-urgent fix window. No CISA KEV listing is present, so there is no confirmed active exploitation; no EPSS score was supplied in the input, so exploitation probability cannot be quantified here; and no PoC or exploit reference is listed (the only reference is the vendor GHSA advisory, not exploit code). The confidentiality impact (C:H) is well-grounded in the description - client memory can be copied into query text sent to the server - and the availability impact (A:H) reflects an application crash; integrity is correctly N. Net: a genuinely interesting memory-disclosure-plus-DoS format-string flaw, but AC:H and UI:R meaningfully limit mass exploitation, and the absence of KEV, EPSS, and any PoC argues against treating it as an immediate threat.

An attacker who controls a PostgreSQL server that is not trusted under the client's current SSL settings, or any database user able to create a table the application later reads with an updatable cursor, names a column using printf-style format directives (e.g. containing %s or %n style tokens). When the psqlODBC client runs a positioned SELECT/UPDATE/DELETE and builds the WHERE clause, the driver expands that attacker-chosen name as a format string with only one argument, reading unrelated process memory. No public exploit identified at time of analysis; only a vendor advisory reference exists.