CVE-2026-120058

A flaw was found in postgresql-odbc. An untrusted database server can exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) on the client system. When cursor-based fetching is enabled, the driver determines its row cache size using the column count from the initial query result but fails to verify that subsequent fetch replies match this layout. By returning responses with mismatched column counts, a malicious server can cause a heap-based buffer overflow or integer underflow on the client.

This vulnerability is rated as Important rather than Critical because successful exploitation requires connecting to an untrusted or compromised database server, or an active network interceptor, alongside a specific cursor fetch configuration. Under default driver deployments, clients typically communicate with trusted backend infrastructure using enforced TLS verification, which impedes unauthorized servers from injecting malformed fetch responses. Furthermore, the issue is only reachable when cursor-based fetching (UseDeclareFetch) is explicitly enabled in the ODBC connection profile or data source configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.