Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-120063 EUVD-2026-115376GHSA-5xmp-p3qm-7hxq

psqlODBC stack buffer overflow when quoting long schema and table names

Published Nov 2, 2026 · Updated Nov 2, 2026 · Assigned by PostgreSQL

Description

When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.

Affected products

VendorProductAffectedFixed
PostgreSQL psqlODBC < 18.00.0006 18.00.0006

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 psqlodbc 1:18.00.0006-1 —
Debian 13 psqlodbc No fix yet —
Debian 12 psqlodbc No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 psqlodbc No fix yet —
Ubuntu 26.04 LTS psqlodbc No fix yet —
Ubuntu 24.04 LTS psqlodbc No fix yet —
Ubuntu 22.04 LTS psqlodbc No fix yet —
Ubuntu 20.04 LTS psqlodbc No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS psqlodbc No fix yet —
Ubuntu 16.04 LTS psqlodbc No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 psqlODBC 18.00.0006-150600.3.5.1 SUSE-SU-2026:5191-1
SLES 15 SP6 psqlODBC 18.00.0006-150600.3.5.1 SUSE-SU-2026:5191-1
SLES 12 SP5 psqlODBC 18.00.0006-1.8.1 SUSE-SU-2026:5192-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 psqlODBC 18.00.0006-150600.3.5.1 SUSE-SU-2026:5191-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed psqlODBC 18.00.0006-1.1 openSUSE-SU-2026:12472-1
openSUSE Leap 16.0 psqlODBC 18.00.0006-bp160.1.1 openSUSE-SU-2026:22261-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 postgresql-odbc +1 18.00.0006-1.amzn2023.0.1 ALAS2023-2026-3427

Advisories 5

References