CVE-2026-120061
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Nov 2, 2026
CISA due date
—
The record
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121249 Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-121
- CVE-2026-120752 PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in… CWE-121
- CVE-2026-29508 ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer… CWE-121
- CVE-2026-58966 In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a… CWE-121
- CVE-2026-120067 For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for… CWE-121
- CVE-2026-120063 When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length… CWE-121
- CVE-2026-106808 OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in… CWE-121
- CVE-2026-106803 A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the… CWE-121