What changed
On November 2, 2026, the PostgreSQL ODBC project announced driver version 18.00.0006. Its maintainer changelog enumerates eleven security fixes, CVE-2026-120057 through CVE-2026-120067, and states that all previous releases are affected. Five listed CVSS 3.1 scores are 7.5 (High), one is 7.1 (High), with the remaining listed as medium. The flaws span large-object reads, row caches, server-supplied column names and counts, ODBC escape parsing, metadata name handling, descriptor indexes, updatable cursors and predictable driver log files. The release also includes hardening changes without assigned CVEs.
Why it matters
The ODBC driver sits inside applications and data tools, so a PostgreSQL server or application input that crosses into unsafe driver code can threaten the client process rather than merely the database. A driver patch can be required even when the PostgreSQL server itself is fully updated. Some issues involve attacker-controlled query or metadata inputs; others depend on specific API calls or server responses. Operators need to inventory the actual ODBC driver installed on desktops, ETL jobs, reporting services and application hosts, not just the database version.
Memory-safety defects affect multiple driver entry points
The changelog lists a large-object read overflowing an application buffer (CVE-2026-120057), a row-cache overflow if a subsequent FETCH changes column count (120058), an ODBC escape-parser stack overflow (120061), invalid binding/descriptor index handling (120064), long-name quoting overflow (120063), and an updatable-cursor keyset read overflow (120067). These are separate bugs with different preconditions, not evidence of one universal remote-execution path. Some listed CVSS scores are High; the project has not published a verified widespread-exploitation claim in the inspected release notice.
Untrusted metadata can become format strings or SQL
The driver could treat a server-provided column name as a format string (CVE-2026-120059), trust server-supplied counts or lengths (120060), fail to escape column names in updatable-cursor queries (120065), or interpolate table/schema names into SQLSpecialColumns queries (120062). The latter is explicitly described as SQL injection. The exact impact depends on the driver call, database permissions and how an application or server supplies these values.
Driver logging creates a local-file trust boundary
CVE-2026-120066 concerns driver logs created at a predictable path with default permissions and symbolic-link following. This is not automatically a network exploit: local file-system access and driver logging configuration may be relevant. Administrators should check whether logging is enabled and where log files are written, especially on shared machines, while upgrading.
Upgrade the client driver and verify actual installations
The maintainer says all releases before 18.00.0006 are affected. Upgrade psqlODBC itself, then check ODBC driver manager registrations, DSNs, architecture-specific Windows installations and packaged ETL/reporting applications for copies that may remain on the old version. Re-test large-object transfers, metadata enumeration, parameter binding and updatable cursors. The October 14 release 18.00.0005 fixed a separate large-parameter heap-corruption bug, but is not sufficient for these November fixes.
Evidence boundary
The PostgreSQL project's announcement and the upstream changelog provide the version and vulnerability inventory. Several linked GitHub Security Advisory pages returned unavailable responses during research, so this dossier does not infer detailed exploit prerequisites or proof-of-concept success beyond the maintainer's descriptions. No verified in-the-wild exploitation or affected-installation count was established.