CVE-2026-120058
Description
A flaw was found in postgresql-odbc. An untrusted database server can exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) on the client system. When cursor-based fetching is enabled, the driver determines its row cache size using the column count from the initial query result but fails to verify that subsequent fetch replies match this layout. By returning responses with mismatched column counts, a malicious server can cause a heap-based buffer overflow or integer underflow on the client.
Déclaration
This vulnerability is rated as Important rather than Critical because successful exploitation requires connecting to an untrusted or compromised database server, or an active network interceptor, alongside a specific cursor fetch configuration. Under default driver deployments, clients typically communicate with trusted backend infrastructure using enforced TLS verification, which impedes unauthorized servers from injecting malformed fetch responses. Furthermore, the issue is only reachable when cursor-based fetching (UseDeclareFetch) is explicitly enabled in the ODBC connection profile or data source configuration.
Mesure d'atténuation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate that subsequent FETCH reply column counts match the initial cursor result layout before writing into the row cache in psqlODBC: upgrade to psqlODBC 18.00.0006 (or the fixed Postgresql Odbc builds), which verify that subsequent FETCH replies match the column layout of the initial cursor result before updating the row cache, closing all 2 injection vectors (malformed FETCH reply returning more columns than the initial cursor result, malformed keyset reply returning fewer columns than expected key fields). Until patched, this is a concern on ODBC clients connecting with UseDeclareFetch enabled without strict server verification, so disable UseDeclareFetch in ODBC data source profiles and enforce strict server certificate verification using sslmode=verify-full or GSSAPI authentication. As a compensating measure, enable Address Space Layout Randomization to hinder attackers from reliably targeting executable memory structures following heap overflow, enable full RELRO and PIE to protect the Global Offset Table and impede overwriting function pointers after heap corruption, and enforce forward-edge Control Flow Integrity or Shadow Call Stack to prevent hijacked control flow from overwritten heap pointers. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap buffer overflow and integer underflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Détails du score du système commun d'évaluation des vulnérabilités (CVSS)
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
Les mesures et les scores CVSS suivants sont préliminaires et sujets à révision.
Répartition des scores CVSS v3
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Score de base | 7.5 | N/A | 7.5 |
| Vecteur d'attaque | Network | N/A | Network |
| Complexité de l'attaque | High | N/A | High |
| Privilèges requis | None | N/A | None |
| Interaction avec l'utilisateur | Required | N/A | Required |
| Champ d'application | Unchanged | N/A | Unchanged |
| Confidentialité | High | N/A | High |
| Impact sur l'intégrité | High | N/A | High |
| Impact sur la disponibilité | High | N/A | High |
Vecteur
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Comprendre la Défaillance (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Questions fréquemment posées
Not sure what something means? Check out our Security Glossary.
Vous souhaitez recevoir des notifications d'errata ? Signez ici.
