CVE-2026-120058 psqlODBC row cache overflow when a later FETCH changes the column count

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

CVE-2026-120058 psqlODBC row cache overflow when a later FETCH changes the column count

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

CVE-2026-120058

The psqlODBC driver is vulnerable to an out-of-bounds write and integer underflow because it sizes its row cache based on the first result of a cursor but fails to verify column counts in subsequent FETCH replies. If UseDeclareFetch is enabled, a malicious server can provide a FETCH with more col...