CVE Feed

    Dashboard / CVE / CVE-2026-120060

    CVE-2026-120060

    psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.

    Published:Nov 2, 2026
    Last Modified:Nov 2, 2026
    EPS:Nov 2, 2026
    EPSS Score:
    CVSS Score:5.9

    Affected Products

    Vendor
    Postgresql
    Product
    Psqlodbc

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-120067 (CVSS 5.9) — For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid …
    CVE-2026-120065 (CVSS 7.1) — For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that c…
    CVE-2026-120066 (CVSS 5.3) — On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from t…
    CVE-2026-120064 (CVSS 7.5) — Several psqlODBC entry points use an application-supplied column number or row index as an array index without…
    CVE-2026-120063 (CVSS 5.9) — When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to…
    CVE-2026-120062 (CVSS 7.5) — SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without es…
    CVE-2026-120061 (CVSS 7.5) — The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} es…
    CVE-2026-120059 (CVSS 6.8) — For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that…
    CVE-2026-120058 (CVSS 7.5) — psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count…
    CVE-2026-120057 (CVSS 7.5) — psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High