CVE-2026-120057

A flaw was found in psqlODBC. When processing large-object read (loread) responses from a database, the driver copies returned data into the application buffer without checking whether the data exceeds the buffer size. A malicious server or a network attacker performing a man-in-the-middle (MitM) attack can supply more data than expected to overwrite memory in the client process. This vulnerability can lead to arbitrary code execution or a Denial of Service (DoS) crash in the client application.

This vulnerability is rated as Important severity because memory corruption leading to potential client-side code execution or denial of service can be triggered remotely by an adversarial server or an unauthenticated network adversary. In Red Hat Enterprise Linux, the issue specifically affects client applications that utilize the postgresql-odbc driver to fetch large-object database fields. Systems remain unaffected if applications do not read large-object data or if connections are strictly restricted to trusted database hosts over verified TLS sessions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.