EUVD-2026-115374Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach app that forwards untrusted SQL
-
DeliverySubmit crafted {fn} escape with excess arguments
-
ExploitOverflow unbounded 16-entry stack offset array
-
ExecutionCorrupt driver process stack
-
ImpactAchieve memory corruption / potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application that forwards untrusted, attacker-influenced SQL text containing ODBC escape sequences directly to psqlODBC. Two distinct triggers are described: (1) a {fn ...} escape supplying more than 16 argument offsets overflows a fixed 16-entry stack array, and a reference to an unsupplied argument reads from an uninitialized array entry, copying arbitrary bytes into the query; (2) copying the body of a {d}, {t}, {ts}, or {escape} escape writes one byte past a 128-byte stack buffer. Limiting factors: applications that use parameterized queries or do not pass raw untrusted SQL through the driver are not exposed; this is not a default-configuration remote flaw but depends on the host application's handling of SQL text. Affected: all versions before psqlODBC 18.00.0006. |
| Impact | This is a genuine memory-corruption flaw (CWE-121 stack buffer overflow) in the official PostgreSQL ODBC driver, but several signals temper its real-world priority. The supplied CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) pairs full confidentiality/integrity/availability impact with high attack complexity (AC:H), which is consistent with a stack smash whose reliable exploitation is non-trivial. The decisive limiter is the precondition in the description: exploitation requires an application that forwards untrusted SQL text - including ODBC escape sequences - straight to the driver, which is an uncommon application design rather than a default-dangerous configuration. No EPSS score, no CISA KEV listing, and no public PoC were supplied, so there is no evidence of active or imminent mass exploitation; the vuln.today 'this_week' label reflects a credible vendor-confirmed memory-corruption bug worth prompt patching, not an emergency. Note a tension to verify: the input vector states PR:L (authenticated), but the described trigger is attacker-controlled SQL text reaching the driver, where the relevant privilege belongs to the hosting application, not the attacker - treat the authentication framing as application-dependent rather than confirmed. |
| Exploit ScenarioDerived | An application built on psqlODBC accepts SQL text from an untrusted source and passes it to the driver unmodified. An attacker submits SQL containing a crafted {fn ...} escape with more than 16 arguments (or a {d}/{t}/{ts}/{escape} body that overruns the 128-byte stack buffer by one byte), corrupting the driver's stack within the application process. No public exploit code was identified at time of analysis, so weaponization would require the attacker to develop a reliable exploit against a high-complexity stack overflow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
A stack-based buffer overflow (CWE-121) in the psqlODBC driver, the official PostgreSQL ODBC driver, lets attacker-influenced SQL text corrupt the memory of any application that forwards it through the driver. Two triggers exist: a {fn ...} ODBC escape with more than 16 argument offsets overflows a fixed 16-entry stack array (and referencing an unsupplied argument copies uninitialized bytes into the query), while copying the body of a {d}, {t}, {ts}, or {escape} escape writes one byte past a 128-byte stack buffer. All versions before 18.00.0006 are affected; no public exploit code was identified at time of analysis, and exposure is confined to applications that pass raw, untrusted SQL text to the driver rather than parameterized queries.
RemediationAI
Upgrade psqlODBC to version 18.00.0006 or later, which is the vendor-released fix; the advisory at https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-hfm6-qfx8-v4xq documents the corrected parser. Because exploitation requires the application to pass attacker-influenced SQL text through the driver, the effective compensating control is to convert such code paths to parameterized queries so untrusted input never reaches psqlODBC's escape-sequence parser as SQL text - this eliminates both the {fn} argument-offset overflow and the fixed 128-byte escape-body copy path, at the cost of application code changes wherever dynamic SQL is currently built by string concatenation. Where conversion is not immediately possible, restrict or sanitize any input that is concatenated into SQL before it is handed to the driver, accepting that this is input filtering rather than a structural fix and may break legitimate SQL using ODBC escape syntax.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
psqlODBC parses ODBC escape sequences embedded in SQL text sent by the client application - {fn ...} for function calls, {d}/{t}/{ts} for date, time and timestamp literals, and {escape ...} for vendor escapes. The parser stores the argument offsets of a {fn} escape in a fixed-size stack array of 16 entries without checking how many arguments the escape actually supplies, so an escape with more argument offsets than the array can hold writes past its end; the same array is not initialized, so an escape that references an argument the caller never supplied causes uninitialized stack bytes to be copied into the outgoing query. Separately, the routine that copies the body of a {d}, {t}, {ts}, or {escape} escape into a 128-byte stack buffer writes one byte beyond that boundary. Both are classic CWE-121 stack-based buffer overflows, and the affected CPE range is postgresql:psqlodbc prior to 18.00.0006. The trigger is not a network-reachable service default but a code path in the client-side driver: it depends entirely on whether the host application hands attacker-influenced SQL text containing escape sequences to psqlODBC.
Know when Psqlodbc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Triggered by attacker-controlled SQL text needing no driver authentication (PR:N), but reliable stack-overflow exploitation plus the uncommon untrusted-SQL-forwarding precondition justify AC:H; full memory corruption gives C/I/A:H.
Primary rating from Vendor (PostgreSQL).
CVSS VectorVendor: PostgreSQL
Lifecycle Timeline
2DescriptionCVE.org
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.
Executive ViewAI
The official PostgreSQL ODBC driver, psqlODBC, contains a high-severity memory corruption vulnerability (CVE-2026-120061) that affects all versions before 18.00.0006. Applications that execute raw SQL text from untrusted sources-rather than using parameterized queries-are at risk of crashes or potential code execution, impacting availability and data integrity. Leadership should prioritize remediation because database drivers are foundational, and exploitation could disrupt critical business systems.
No vendor-released patch identified at time of analysis; interim mitigations include forcing parameterized queries, validating and sanitizing all SQL input, and isolating affected applications until patched.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Out-of-bounds reads and writes in psqlODBC before 18.00.0006 arise when a host application forwards untrusted column num
SQL injection in psqlODBC before 18.00.0006 allows an attacker who can influence a table or schema name passed by a host
Heap out-of-bounds write in the psqlODBC driver (CWE-787) affects all versions before 18.00.0006 and is reachable only w
A heap buffer overflow in psqlODBC's large-object read path lets a malicious or man-in-the-middle PostgreSQL server over
SQL injection in psqlODBC before 18.00.0006 can let an authenticated database user who can create a table that an applic
Format-string handling in psqlODBC before 18.00.0006 can crash applications or disclose client memory when an updatable
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more
A stack-based buffer overflow in psqlODBC, the PostgreSQL ODBC driver, affects all releases before 18.00.0006 when updat
Stack buffer over-write in psqlODBC before 18.00.0006 can corrupt an application process that forwards attacker-influenc
Client-side crash and limited out-of-bounds read affect psqlODBC before 18.00.0006 when the driver connects to a Postgre
psqlODBC before 18.00.0006 on Unix-like systems can expose query text and data to other local users when logging is enab
Exploit-DB