PostgreSQL: psqlODBC memory corruption via large-object read (CVE-2026-120057)
The psqlODBC driver is vulnerable to memory corruption during loread operations because it fails to validate server-provided data lengths against buffer sizes.
CVE search metadata
CVE search record: CVE-2026-120057. Severity: high. CVSS: 7.5. KEV: no. Product: psqlODBC (versions before 18.00.0006), psqlODBC (< 18.00.0006). Brief: PostgreSQL: psqlODBC memory corruption via large-object read (CVE-2026-120057). Brief link: https://feed.craftedsignal.io/briefs/2026-11-psqlodbc-memory-corruption/
CVE search record: CVE-2026-120065. Severity: high. CVSS: 7.1. KEV: no. Product: psqlODBC (versions before 18.00.0006), psqlODBC (< 18.00.0006). Brief: PostgreSQL: psqlODBC memory corruption via large-object read (CVE-2026-120057). Brief link: https://feed.craftedsignal.io/briefs/2026-11-psqlodbc-memory-corruption/
Triage facts
Revision 2- Applicability
- psqlODBC (versions before 18.00.0006), psqlODBC (< 18.00.0006)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 2, 21:52 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
added CVE-2026-120065
Changed: affected_products, cves, lastmod, references, updates
Sources: 1
A memory corruption vulnerability exists in the psqlODBC driver. During large-object read (loread) operations, the driver copies data into the application's buffer using the length provided by the server without comparing it to the actual buffer size. An untrusted server or a man-in-the-middle can provide an excessive length, causing the driver to return more bytes than the buffer can hold, resulting in an overwrite of adjacent memory in the client process. Fetching any large-object column can trigger this condition.