Answer in brief
CVE-2026-120064 records a High severity (CVSS 7.5) vulnerability in psqlODBC does not validate column numbers and row indexes in binding and descriptor functions. The current sources do not mark it as known exploited. The current feed maps PostgreSQL/psqlODBC (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps PostgreSQL/psqlODBC (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| PostgreSQL/psqlODBCgeneric | >=0 <18.00.0006 | 18.00.0006 |
Published upstream
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 2, 2026
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.
Quoted source text, attributed separately from HOL analysis.