CVE-2026-120057

The psqlODBC driver is vulnerable to a buffer overflow when performing a large-object read (loread ). The software copies the reply from the server into the application's buffer using the length provided by the server without verifying if it exceeds the buffer size. An attacker or a man-in-the-mi...

CVE-2026-120057 psqlODBC large-object read overflows the application buffer

psqlODBC copies the reply to a large-object read loread into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite...

CVE-2026-120057: PostgreSQL psqlODBC: psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the…

psqlODBC copies the reply to a large-object read loread into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite...

CVE-2026-6477

Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets, PQfn..., resultisint=0, ... stores arbitrary-lengt...