5.9
Moyenne
CVE-2026-109448 Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters…
Description
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| psqlODBC 08.01 | 08.01.0102 → < 18.00.0005 | 18.00.0005 |
Autres CVE de psqlODBC
Les 12 CVE de psqlODBC →
CVE-2026-120067
For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to…
5.9
Moyenne
CVE-2026-120065
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to…
7.1
Élevée
CVE-2026-120066
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program…
5.3
Moyenne
CVE-2026-120064
Several psqlODBC entry points use an application-supplied column number or row index as an array index without…
7.5
Élevée