psqlODBC CVE-2026-120063

Exploitation requires an application that forwards untrusted SQL text to psqlODBC, where the attacker-influenced identifier exceeds the 128-byte stack buffer. Two concrete paths are named: (1) the table name of a statement the driver parses to describe its columns, and (2) the target table of the last INSERT when the driver rewrites SELECT @@IDENTITY - both sourced from the application's SQL text and causing up to a two-byte over-write. A third path requires a malicious or compromised PostgreSQL server to return an overlong column name during the @@IDENTITY rewrite, causing a one-byte over-write. Limiting factors: only a double quote and NUL are written and their content is attacker-uncontrolled; identifiers must be long enough to exceed 128 bytes; the application must actually expose/forward untrusted identifiers; and only versions before psqlODBC 18.00.0006 are affected. The complete fix is upgrading to 18.00.0006 as stated by the vendor.

This is a moderate-severity issue (CVSS 5.9) whose signals point to a defect worth patching on a normal cycle rather than an emergency. The input CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) describes a network-reachable but high-complexity flaw requiring some privilege (PR:L), with no confidentiality impact, low integrity impact, and high availability impact - consistent with the mechanism described: a bounded overwrite of just two fixed bytes (a double quote and a NUL) past a 128-byte stack buffer, with the attacker controlling the length of a name but not the overwritten content. Because only a quote and NUL are written and the attacker cannot choose those bytes, reliable code execution is unlikely and the realistic outcome is stack corruption and process crash, matching the A:H / I:L weighting. The vuln.today priority is 'this_month', which aligns with medium real-world risk. There is no CISA KEV listing and no EPSS score in the supplied data, so exploitation probability cannot be quantified here; the only reference is the vendor security advisory (GHSA-285r-84w3-xcxv), not a working exploit, so no public exploit identified at time of analysis. One tension to verify: the CVSS marks AV:N, but the description shows the trigger requires either an application that forwards untrusted SQL identifiers to the driver or, for the @@IDENTITY path, a malicious or compromised PostgreSQL server returning a long column name - so real-world reachability depends heavily on how the consuming application exposes SQL text, not on the driver alone.

An attacker who can influence the SQL text an application passes to psqlODBC supplies an overlong schema or table name (exceeding the 128-byte buffer); when the driver quotes that name to describe a statement's columns or to rewrite SELECT @@IDENTITY against the last INSERT target, the flawed length check lets it write a double quote and NUL up to two bytes past the stack buffer, corrupting the stack and likely crashing the process. Alternatively, a malicious or compromised PostgreSQL server can return an overlong column name during the @@IDENTITY rewrite to force a one-byte overflow. No public exploit identified at time of analysis; only the vendor advisory is available.