# psqlODBC 18.00.0006 patches 11 security flaws across PostgreSQL ODBC clients The November 2 PostgreSQL ODBC release fixes eleven CVEs, including memory corruption, SQL injection and unsafe log-file creation; maintainers say all earlier driver releases are affected. Applications using the PostgreSQL ODBC driver should upgrade to 18.00.0006 and review where client or server-supplied names, ODBC escape sequences and driver logs cross trust boundaries. - Status: Active - Published: 2026-11-03T16:20:09+13:00 - Updated: 2026-11-03T16:20:09+13:00 - Categories: Web Development, Cloud & Infrastructure, Developer Tools, Databases & Storage - Tags: CVE-2026-120057, database operations, PostgreSQL, security, SQL injection - Canonical HTML: https://beyondthe.news/dossiers/psqlodbc-18-00-0006-eleven-security-cves-buffer-overflow-sql-injection ## What changed On November 2, 2026, the PostgreSQL ODBC project announced driver version 18.00.0006. Its maintainer changelog enumerates eleven security fixes, CVE-2026-120057 through CVE-2026-120067, and states that all previous releases are affected. Five listed CVSS 3.1 scores are 7.5 (High), one is 7.1 (High), with the remaining listed as medium. The flaws span large-object reads, row caches, server-supplied column names and counts, ODBC escape parsing, metadata name handling, descriptor indexes, updatable cursors and predictable driver log files. The release also includes hardening changes without assigned CVEs. ## Why it matters The ODBC driver sits inside applications and data tools, so a PostgreSQL server or application input that crosses into unsafe driver code can threaten the client process rather than merely the database. A driver patch can be required even when the PostgreSQL server itself is fully updated. Some issues involve attacker-controlled query or metadata inputs; others depend on specific API calls or server responses. Operators need to inventory the actual ODBC driver installed on desktops, ETL jobs, reporting services and application hosts, not just the database version. ## Memory-safety defects affect multiple driver entry points The changelog lists a large-object read overflowing an application buffer (CVE-2026-120057), a row-cache overflow if a subsequent FETCH changes column count (120058), an ODBC escape-parser stack overflow (120061), invalid binding/descriptor index handling (120064), long-name quoting overflow (120063), and an updatable-cursor keyset read overflow (120067). These are separate bugs with different preconditions, not evidence of one universal remote-execution path. Some listed CVSS scores are High; the project has not published a verified widespread-exploitation claim in the inspected release notice. ## Untrusted metadata can become format strings or SQL The driver could treat a server-provided column name as a format string (CVE-2026-120059), trust server-supplied counts or lengths (120060), fail to escape column names in updatable-cursor queries (120065), or interpolate table/schema names into SQLSpecialColumns queries (120062). The latter is explicitly described as SQL injection. The exact impact depends on the driver call, database permissions and how an application or server supplies these values. ## Driver logging creates a local-file trust boundary CVE-2026-120066 concerns driver logs created at a predictable path with default permissions and symbolic-link following. This is not automatically a network exploit: local file-system access and driver logging configuration may be relevant. Administrators should check whether logging is enabled and where log files are written, especially on shared machines, while upgrading. ## Upgrade the client driver and verify actual installations The maintainer says all releases before 18.00.0006 are affected. Upgrade psqlODBC itself, then check ODBC driver manager registrations, DSNs, architecture-specific Windows installations and packaged ETL/reporting applications for copies that may remain on the old version. Re-test large-object transfers, metadata enumeration, parameter binding and updatable cursors. The October 14 release 18.00.0005 fixed a separate large-parameter heap-corruption bug, but is not sufficient for these November fixes. ## Evidence boundary The PostgreSQL project's announcement and the upstream changelog provide the version and vulnerability inventory. Several linked GitHub Security Advisory pages returned unavailable responses during research, so this dossier does not infer detailed exploit prerequisites or proof-of-concept success beyond the maintainer's descriptions. No verified in-the-wild exploitation or affected-installation count was established. ## Key details - Release announced November 2, 2026: psqlODBC 18.00.0006. - Eleven CVEs: CVE-2026-120057 through CVE-2026-120067. - Upstream says all prior driver releases are affected. - High-severity entries include buffer overflows, SQLSpecialColumns injection and invalid index handling. - The PostgreSQL database server version alone does not determine the vulnerable ODBC driver version. - Security advisory pages were not independently accessible at research time. ## Builder takeaways - Inventory PostgreSQL ODBC driver versions in application hosts, reporting tools and ETL workers. - Upgrade psqlODBC to 18.00.0006 or a vendor-confirmed backport; updating the server alone is insufficient. - Test ODBC workflows using large objects, metadata calls, cursor updates and parameter binding after the upgrade. - Check local driver logging locations and permissions, especially on shared hosts. - Do not treat every listed CVE as remotely exploitable without its specific prerequisites. ## What to watch - Maintainer or distributor advisories clarifying exploit conditions and backports. - Any independently verified exploitation or further psqlODBC security follow-up. - Regression reports in driver managers and ODBC client applications after 18.00.0006. ## Uncertainties - No in-the-wild exploitation or affected-installation count was established. - Individual CVE prerequisites vary; linked advisory pages were unavailable when checked. - The upstream changelog's CVSS scores and affected-version statement were not independently reproduced. ## Sources - [Security release for psqlodbc](https://www.postgresql.org/about/news/security-release-for-psqlodbc-3431/) — PostgreSQL ODBC project · primary project release announcement · 2026-11-02T00:00:00+13:00. Confirms release 18.00.0006 and multiple security fixes. - [psqlODBC Changelog — 18.00.0006](https://github.com/postgresql-interfaces/psqlodbc/blob/main/Changelog.md) — PostgreSQL Interfaces · primary maintainer changelog · 2026-11-02T00:00:00+13:00. Enumerates eleven CVEs, severity scores, affected versions and hardening changes. - [PostgreSQL Security News Archive](https://www.postgresql.org/about/newsarchive/security/) — PostgreSQL · primary security archive · 2026-11-03T00:00:00+13:00. Distinguishes the new November driver release from October's 18.00.0005 and other PostgreSQL components.