CVE-2026-120057 psqlODBC large-object read overflows the application buffer
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-120057?
CVE-2026-120057 is a high-severity vulnerability in PostgreSQL psqlODBC, published on 2 Nov 2026.
Official description
psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.
Weakness: CWE-120
Which versions are affected by CVE-2026-120057?
How do I fix CVE-2026-120057?
Upgrade to a fixed version.
Is CVE-2026-120057 being exploited?
There is no known exploitation of CVE-2026-120057 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-120057, GHSA-5wgw-m382-jcv2, GHSA-qhmr-5339-q33r, UBUNTU-CVE-2026-120057.