PostgreSQL ODBC: the application’s driver needs its own update

The component between the application and the database

psqlODBC is the driver that lets an application using the ODBC interface communicate with PostgreSQL. CERTFR-2026-AVI-1445, dated 3 November, covers this component before 18.00.0006, not a PostgreSQL server release with that number. An application can therefore retain a vulnerable driver after the server has been updated.

The eleven NVD records describe different paths. Some attacks use replies from a server that is not trusted under the current SSL settings. Others depend on values passed from the application to the driver, an updatable cursor or enabled logging. Having PostgreSQL on the network does not by itself meet all these conditions.

What the client processes matters

For CVE-2026-120057, the driver copies a large-object read reply using the length sent by the server, without comparing it with the application’s buffer size. A server not trusted under the current SSL settings, or a man-in-the-middle, can return too many bytes and overwrite memory in the client process. The record identifies fetching a large-object column as sufficient to trigger it.

CVE-2026-120062 concerns SQLSpecialColumns: untrusted table or schema names are inserted into a catalog query without escaping. If the application passes these names to that function, the caller can execute SQL with the connection’s privileges. CVE-2026-120065 follows a different path, involving an improperly quoted column name in certain updatable cursors; it can change which rows a positioned update or delete affects.

CVE-2026-120066 affects Unix-like systems when logging is enabled. By default, the driver creates predictably named logs in /tmp, typically with world-readable permissions, and follows symbolic links. A local user can read query text and data, or cause log data to be appended to another file with the victim’s privileges. This does not mean that every database is automatically exposed.

Identify the driver that is actually loaded

Ask the application’s maintainer whether it uses psqlODBC, where the driver is installed and which version it actually loads. Different applications or environments can have separate copies. Neither the server’s version nor the application’s version establishes the driver version.

The reference version in these sources is 18.00.0006. Follow the update channel for your application or distribution; do not manually replace a bundled file without checking compatibility. After the update and any required restart, have the loaded driver checked, then verify a connection and the operations you need in a test environment. Preserve a recovery path appropriate to the data and configuration.

Reviewing connection privileges, untrusted inputs and logging remains useful. It does not replace the fix. This brief does not recommend changing SSL settings at random or disabling a check merely to restore a connection.

• Plan a service’s updates and recovery↗

What the sources establish

Each of the eleven NVD responses read on 4 November contains a record, but none yet has CPE configurations. We use their descriptions and the psqlODBC version boundary they give, without inventing a list of fixed distribution packages. We also read the CERT-FR advisory, not the PostgreSQL bulletin it links to.

We have not installed a driver or application, reproduced these flaws or checked a deployment. These sources describe vulnerabilities; this reading does not establish active exploitation or compromise of your application.