5.9
Medium
CVE-2026-109448 Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters…
Description
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| psqlODBC 08.01 | 08.01.0102 → < 18.00.0005 | 18.00.0005 |
Other CVEs of psqlODBC
The 12 CVEs of psqlODBC →
CVE-2026-120067
For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to…
5.9
Medium
CVE-2026-120065
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to…
7.1
High
CVE-2026-120066
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program…
5.3
Medium
CVE-2026-120064
Several psqlODBC entry points use an application-supplied column number or row index as an array index without…
7.5
High