EUVD-2026-115372

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT,...

CVE-2026-120067

For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes...

CVE-2026-120065

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120065 psqlODBC does not escape a server-supplied column name in its updatable-cursor queries

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120065 psqlODBC does not escape a server-supplied column name in its updatable-cursor queries

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120065

Versions of psqlODBC before 18.00.0006 are vulnerable to SQL injection due to improper handling of server-supplied column names in updatable cursors. When a table lacks OIDs but has an auto-increment int4 column, the driver uses that column for row identification. It places the column name betwee...

CVE-2026-120059

The psqlODBC driver (versions before 18.00.0006 ) is vulnerable to a CWE-134 Use of Externally-Controlled Format String. When using an updatable cursor over a table without OIDs containing an auto-increment int4 column, the driver places the server-reported column name into a printf-style format ...

CVE-2026-120059 psqlODBC uses a server-supplied column name as a format string

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT,...

CVE-2026-120059 psqlODBC uses a server-supplied column name as a format string

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT,...

CVE-2026-120065: PostgreSQL psqlODBC: For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to…

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120059: PostgreSQL psqlODBC: For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's…

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT,...