CVE-2026-120061

The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a fn escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument...