Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2026-109448: psqlODBC corrupts memory when over 32,767 parameters
CVE-2026-109448 · published 23 days ago
Summary
The PostgreSQL ODBC driver (psqlODBC) versions before 18.00.0005 can mishandle statements that use more than 32,767 parameters, causing memory to become corrupted and the application to crash or behave unpredictably. This risk appears when an application builds a list of parameters from outside input, such as a user‑generated list. Update the driver to version 18.00.0005 or later to prevent the issue.
What to do
- Update debian psqlodbc to version 1:18.00.0005-1.
- Update postgresql psqlodbc to version 18.00.0005 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | postgresql | psqlodbc | < 18.00.0005 |
| Debian:12 | debian | psqlodbc | All versions |
| Alpaquita:23 | bellsoft | psqlodbc | >= 16.00.0000-r0 |
| Alpaquita:25 | bellsoft | psqlodbc | >= 16.00.0005-r0 |
| Ubuntu:16.04:LTS | canonical | psqlodbc | All versions |
| Debian:14 | debian | psqlodbc |
< 1:18.00.0005-1 Fix: upgrade to 1:18.00.0005-1
|
Original advisory text
psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.
References
- https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-cmfx-... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-109448 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-109448 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-109448 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-109448 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1094... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109448 Vendor Advisory
- https://github.com/postgresql-interfaces/psqlodbc Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-124Buffer Underwrite ('Buffer Underflow')
CWE-190Integer Overflow
Timeline
Published12 Oct 2026
Updated4 Nov 2026
First seen12 Oct 2026
Sources
CVE-2026-109448 · NVD
CVE-2026-109448 · MITRE
DEBIAN-CVE-2026-109448 · OSV
CVE-2026-109448 · OSV
GHSA-cmfx-rm3r-p2jr · GHSA
BELL-CVE-2026-109448 · OSV
UBUNTU-CVE-2026-109448 · OSV
Track software like this
Free during beta