Bug 2565364 (CVE-2026-120058)

Summary: CVE-2026-120058 postgresql-odbc: postgresql-odbc: Arbitrary code execution via heap buffer overflow during cursor fetch
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in postgresql-odbc. An untrusted database server can exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) on the client system. When cursor-based fetching is enabled, the driver determines its row cache size using the column count from the initial query result but fails to verify that subsequent fetch replies match this layout. By returning responses with mismatched column counts, a malicious server can cause a heap-based buffer overflow or integer underflow on the client.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-02 19:33:42 UTC 
psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.