What is CVE-2026-120064 in psqlODBC?
CVE-2026-120064 is a critical security flaw with a CVSS score of 7.5 affecting the psqlODBC driver como otras vulnerabilidades criticas. Vいくつかの psqlODBC entry points fail to validate application-supplied column numbers or row indexes before utilizing them as array indices.
The flaw involves CWE-129 and CWE-190 weaknesses, which manifest through improper validation of array indices and integer overflows. Functions such as SQLBindCol, SQLColAttribute, and SQLSetPos are implicated when handling extreme or negative index values.
Who is affected and how does it work?
Applications that forward untrusted column or row numbers directly into the driver expose their host processes to out-of-bounds reads and writes. This can cause memory corruption, crashes, or potential security bypasses.
Attackers or faulty workflows exploiting functions like SQLBindCol with column numbers above 32767 trigger negative binding counts that run off array boundaries. Similarly, negative SQL_DESC_COUNT values unbind columns at erroneous negative indexes.
How do I protect my systems?
Mitigating this vulnerability requires immediate updates and careful auditing of application database interactions. Similar to handling fallos de escalada de privilegios, proactive patch management is essential for stability.
Follow these steps to secure your environment against this flaw:
- Upgrade the psqlODBC driver to version 18.00.0006 or later.
- Audit application code to ensure column and row numbers from untrusted sources are strictly validated before making ODBC calls.
- Review advisory details provided in la referencia tecnica en github for additional implementation guidelines.