psqlODBC 18.00.0006 Fixes Vulnerabilities Including an SQL Injection in SQLSpecialColumns and Several Buffer Overflows; All Earlier Releases Affected

Overview

The PostgreSQL ODBC project announced a security release for psqlODBC on 2026-11-02. According to the PostgreSQL news archive, the project “has released version 18.00.0006 to fix multiple security issues” and points readers to the changelog for details. The project’s GitHub release tag page carries a release titled psqlODBC 18.00.0006.

What the Changelog Lists

The psqlODBC changelog says: “This release fixes the following vulnerabilities. All releases before 18.00.0006 are affected.” It lists CVE-2026-120057 through CVE-2026-120067, each with a GitHub security advisory ID and a CVSS 3.1 rating. By the Herald’s own count of that list, there are 11 entries: six rated High and five rated Medium.

The entries rated High, with the changelog’s descriptions, are:

• CVE-2026-120057: large-object read overflows the application buffer (CVSS 3.1 7.5)
• CVE-2026-120058: row cache overflow when a later FETCH changes the column count (7.5)
• CVE-2026-120061: ODBC escape parser stack buffer overflow (7.5)
• CVE-2026-120062: SQL injection through SQLSpecialColumns table and schema names (7.5)
• CVE-2026-120064: the driver does not validate column numbers and row indexes in binding and descriptor functions (7.5)
• CVE-2026-120065: the driver does not escape a server-supplied column name in its updatable-cursor queries (7.1)

The entries rated Medium, per the same changelog, are:

• CVE-2026-120059: the driver uses a server-supplied column name as a format string (6.8)
• CVE-2026-120060: the driver does not validate server-supplied counts and lengths (5.9)
• CVE-2026-120063: stack buffer overflow when quoting long schema and table names (5.9)
• CVE-2026-120066: log files are created with default permissions at a predictable path and follow symbolic links (5.3)
• CVE-2026-120067: stack buffer overflow when reading the keyset (ctid/oid) columns of an updatable cursor (5.9)

Three of the entries (CVE-2026-120059, CVE-2026-120060 and CVE-2026-120065) are described in the changelog in terms of data the server supplies, such as column names, counts and lengths.

Hardening Changes Without CVEs

The changelog says the release also contains hardening changes and that “They have no demonstrated attack path and no CVE.” By the Herald’s count there are four bullet points. They cover SQLSetDescRecW storing a freed buffer and the address of a local variable as deferred bound data, SQLColumns returning uninitialized relkind and table OID values when the table query returned no rows, convert_linefeeds possibly dereferencing a NULL pointer in one build configuration, and width, length and bounds checks in secure_sscanf, msgtowstr and the MSDTC connect-string append.

Preceding Release

The changelog’s entry for 18.00.0005 includes a fix for heap memory corruption when an application binds more than 32767 parameters on one statement, referencing advisory GHSA-cmfx-rm3r-p2jr.

What We Don’t Know

The announcement and changelog do not say whether any of the issues has been exploited, and the sources reviewed here do not describe mitigations for users who cannot upgrade. The changelog entries are one-line descriptions; the linked GitHub security advisories hold any further detail.