{"id":"CVE-2026-120063","aliases":["DEBIAN-CVE-2026-120063","EUVD-2026-115376","GHSA-285r-84w3-xcxv","GHSA-5xmp-p3qm-7hxq","UBUNTU-CVE-2026-120063","openSUSE-SU-2026:12472-1","openSUSE-SU-2026:22261-1"],"status":"published","title":"psqlODBC stack buffer overflow when quoting long schema and table names","description":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00271,"percentile":0.1952,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2026-11-02T19:09:12Z","modified":"2026-11-11T17:27:07Z","fixes":[{"ecosystem":"Debian:14","package":"psqlodbc","fixed_in":["1:18.00.0006-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.02.0000-2","1:15.00.0000-1","1:16.00.0000-1","1:16.00.0005-1","1:17.00.0004-1","1:17.00.0004-2","1:17.00.0005-1","1:17.00.0006-1","1:17.00.0006-2","1:17.00.0007-1","1:17.00.0008-1","1:18.00.0001-1","1:18.00.0002-1","1:18.00.0003-1","1:18.00.0003-2","1:18.00.0004-1","1:18.00.0005-1","1:18.00.0006-1"]},{"source":"osv","ecosystem":"Debian:13","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.00.0004-2","1:17.00.0005-1","1:17.00.0006-1","1:17.00.0006-2","1:17.00.0007-1","1:17.00.0008-1","1:18.00.0001-1","1:18.00.0002-1","1:18.00.0003-1","1:18.00.0003-2","1:18.00.0004-1","1:18.00.0005-1","1:18.00.0006-1"]},{"source":"osv","ecosystem":"Debian:14","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.00.0006-1"}]}],"versions":["1:17.00.0004-2","1:17.00.0005-1","1:17.00.0006-1","1:17.00.0006-2","1:17.00.0007-1","1:17.00.0008-1","1:18.00.0001-1","1:18.00.0002-1","1:18.00.0003-1","1:18.00.0003-2","1:18.00.0004-1","1:18.00.0005-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:09.03.0300-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:09.06.0410-1","1:10.00.0000-1","1:10.01.0000-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:11.00.0000-1","1:12.00.0000-1","1:12.01.0000-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.00.0000-1","1:13.02.0000-1","1:13.02.0000-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:15.00.0000-1","1:16.00.0000-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.00.0007-1","1:18.00.0001-1","1:18.00.0002-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.00.0006-2","1:17.00.0007-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-bp160.1.1"}]}],"bundled":11}],"products":[{"vendor":"postgresql","product":"psqlodbc"}],"references":[{"url":"https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-285r-84w3-xcxv","tags":["vendor-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120063","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5xmp-p3qm-7hxq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120063.json","tags":["advisory"]},{"url":"https://github.com/postgresql-interfaces/psqlodbc","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-120063","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-120063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120063","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120067","tags":["web"]},{"url":"https://bugzilla.suse.com/1289252","tags":["report"]},{"url":"https://bugzilla.suse.com/1289253","tags":["report"]},{"url":"https://bugzilla.suse.com/1289254","tags":["report"]},{"url":"https://bugzilla.suse.com/1289255","tags":["report"]},{"url":"https://bugzilla.suse.com/1289256","tags":["report"]},{"url":"https://bugzilla.suse.com/1289257","tags":["report"]},{"url":"https://bugzilla.suse.com/1289258","tags":["report"]},{"url":"https://bugzilla.suse.com/1289259","tags":["report"]},{"url":"https://bugzilla.suse.com/1289260","tags":["report"]},{"url":"https://bugzilla.suse.com/1289261","tags":["report"]},{"url":"https://bugzilla.suse.com/1289262","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-120063","title":"psqlODBC stack buffer overflow when quoting long schema and table names","description":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:09:12.867Z","modified":"2026-11-02T19:36:16.948Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T20:51:24.336573Z"}],"euvd":[{"id":"EUVD-2026-115376","description":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:09:12Z","modified":"2026-11-02T19:36:16Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-03T05:08:38.228652Z"}],"ghsa":[{"id":"GHSA-5xmp-p3qm-7hxq","title":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets...","description":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T21:31:57Z","modified":"2026-11-02T21:31:57Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-03T00:02:47.574481Z"}],"nvd":[{"id":"CVE-2026-120063","description":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:18:03.557Z","modified":"2026-11-02T20:17:39.553Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-03T00:02:42.67885Z"}],"osv":[{"id":"CVE-2026-120063","title":"psqlODBC stack buffer overflow when quoting long schema and table names","description":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:09:12.867Z","modified":"2026-11-11T17:27:07.85904108Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-08T02:57:14.556074Z"},{"id":"DEBIAN-CVE-2026-120063","description":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:18:03.557Z","modified":"2026-11-05T10:00:42.595805258Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"UBUNTU-CVE-2026-120063","description":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:18:00Z","modified":"2026-11-05T04:42:52Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-05T13:33:25.727744Z"},{"id":"openSUSE-SU-2026:12472-1","title":"psqlODBC-18.00.0006-1.1 on GA media","description":"These are all security issues fixed in the psqlODBC-18.00.0006-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:16.02618632Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"openSUSE-SU-2026:22261-1","title":"Security update for psqlODBC","description":"This update for psqlODBC fixes the following issues:\n\nChanges in psqlODBC:\n\n- Update to 18.00.0006:\n  * Large-object read overflows the application buffer\n    (CVE-2026-120057, bsc#1289252).\n  * Row cache overflow when a later FETCH changes the column count\n    (CVE-2026-120058, bsc#1289253).\n  * Driver uses a server-supplied column name as a format string\n    (CVE-2026-120059, bsc#1289254).\n  * Driver does not validate server-supplied counts and lengths\n    (CVE-2026-120060, bsc#1289255).\n  * ODBC escape parser stack buffer overflow\n    (CVE-2026-120061, bsc#1289256).\n  * SQL injection through SQLSpecialColumns table and schema names\n    (CVE-2026-120062, bsc#1289257).\n  * Stack buffer overflow when quoting long schema and table names\n    (CVE-2026-120063, bsc#1289258).\n  * Driver does not validate column numbers and row indexes in\n    binding and descriptor functions\n    (CVE-2026-120064, bsc#1289259).\n  * Driver does not escape a server-supplied column name in its\n    updatable-cursor queries (CVE-2026-120065, bsc#1289260).\n  * Log files are created with default permissions at a predictable\n    path and follow symbolic links\n    (CVE-2026-120066, bsc#1289261).\n  * Stack buffer overflow when reading the keyset (ctid/oid)\n    columns of an updatable cursor\n    (CVE-2026-120067, bsc#1289262).\n  * Hardening: SQLSetDescRecW stored a freed buffer and the address\n    of a local variable as deferred bound data. It now stores the\n    application's pointers, as SQLSetDescRec does.\n  * Hardening: SQLColumns returned uninitialized relkind and table\n    OID values when the table query returned no rows.\n  * Hardening: convert_linefeeds could dereference a NULL pointer\n    in one build configuration.\n  * Hardening: secure_sscanf limits an over-wide %Ns width,\n    msgtowstr checks for a zero buffer length, and the MSDTC\n    connect-string append is bounded.\n","status":"published","published":"2026-11-06T16:51:52Z","modified":"2026-11-11T17:23:13.168183448Z","updated_at":"2026-11-11T17:47:15.466074Z"}]}}