Psqlodbc
Monthly
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more parameters on a single SQL statement via SQLBindParameter. An attacker who controls the parameter count-for example through an untrusted 'IN (?, ?, ...)' list-can wrap the driver's signed 16-bit binding counter, causing a massive out-of-bounds write of zeros that crashes the application or leaves it running with a corrupted heap. No public exploit code has been identified at time of analysis, and exploitation requires a vulnerable application pattern where parameter counts are derived from untrusted input; the flaw is availability-only (CVSS 5.9).
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more parameters on a single SQL statement via SQLBindParameter. An attacker who controls the parameter count-for example through an untrusted 'IN (?, ?, ...)' list-can wrap the driver's signed 16-bit binding counter, causing a massive out-of-bounds write of zeros that crashes the application or leaves it running with a corrupted heap. No public exploit code has been identified at time of analysis, and exploitation requires a vulnerable application pattern where parameter counts are derived from untrusted input; the flaw is availability-only (CVSS 5.9).