CVE-2026-120058

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120058", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-30T19:25:18.919Z", "datePublished": "2026-11-02T19:09:09.747Z", "dateUpdated": "2026-11-02T19:33:49.913Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-02T19:09:09.747Z"}, "title": "psqlODBC row cache overflow when a later FETCH changes the column count", "datePublic": "2026-11-02T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected."}], "affected": [{"vendor": "PostgreSQL", "product": "psqlODBC", "repo": "https://github.com/postgresql-interfaces/psqlodbc", "programFiles": ["qresult.c"], "programRoutines": [{"name": "QR_from_PGresult"}], "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "18.00.0006", "status": "affected", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "workarounds": [{"lang": "en", "value": "Set UseDeclareFetch=0, or connect only to servers authenticated with sslmode=verify-full or an equivalent GSS setting."}], "solutions": [{"lang": "en", "value": "Upgrade to psqlODBC 18.00.0006 or later. The driver rejects a column count that changes between fetches of the same cursor, and a keyset reply with fewer columns than the key fields."}], "references": [{"url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-6rmx-9q62-4w6m", "tags": ["vendor-advisory"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T19:33:38.487446Z", "id": "CVE-2026-120058", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:33:49.913Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120058", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T19:33:38.487446Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:33:44.708Z"}}], "cna": {"title": "psqlODBC row cache overflow when a later FETCH changes the column count", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/postgresql-interfaces/psqlodbc", "vendor": "PostgreSQL", "product": "psqlODBC", "versions": [{"status": "affected", "version": "0", "lessThan": "18.00.0006", "versionType": "custom"}], "programFiles": ["qresult.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "QR_from_PGresult"}]}], "solutions": [{"lang": "en", "value": "Upgrade to psqlODBC 18.00.0006 or later. The driver rejects a column count that changes between fetches of the same cursor, and a keyset reply with fewer columns than the key fields."}], "datePublic": "2026-11-02T00:00:00.000Z", "references": [{"url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-6rmx-9q62-4w6m", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Set UseDeclareFetch=0, or connect only to servers authenticated with sslmode=verify-full or an equivalent GSS setting."}], "descriptions": [{"lang": "en", "value": "psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-02T19:09:09.747Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120058", "state": "PUBLISHED", "dateUpdated": "2026-11-02T19:33:49.913Z", "dateReserved": "2026-10-30T19:25:18.919Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-11-02T19:09:09.747Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "psqlODBC", "programFiles": ["qresult.c"], "programRoutines": [{"name": "QR_from_PGresult"}], "repo": "https://github.com/postgresql-interfaces/psqlodbc", "vendor": "PostgreSQL", "versions": [{"lessThan": "18.00.0006", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected."}], "id": "CVE-2026-120058", "lastModified": "2026-11-02T20:17:38.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120058", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T19:33:38.487446Z", "version": "2.0.3"}}]}, "published": "2026-11-02T19:18:02.857", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-6rmx-9q62-4w6m"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}, {"lang": "en", "value": "CWE-787"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql-odbc: postgresql-odbc: Arbitrary code execution via heap buffer overflow during cursor fetch", "id": "2565364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565364"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in postgresql-odbc. An untrusted database server can exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) on the client system. When cursor-based fetching is enabled, the driver determines its row cache size using the column count from the initial query result but fails to verify that subsequent fetch replies match this layout. By returning responses with mismatched column counts, a malicious server can cause a heap-based buffer overflow or integer underflow on the client."], "name": "CVE-2026-120058", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "postgresql-odbc", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-11-02T19:09:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120058\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120058\nhttps://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-6rmx-9q62-4w6m"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,18.00.0006)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "psqlODBC", "source": "cna", "vendor": "PostgreSQL"}, "product": "psqlodbc", "vendor": "postgresql"}], "created": "2026-11-02T20:45:07.022034+00:00", "updated": "2026-11-02T20:45:07.598802+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$psqlodbc"]}