CVE-2026-109448
MEDIUM
5,9
Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Description
AI Translation Available
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.
124
Buffer Underwrite ('Buffer Underflow')
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Availability
Confidentiality
Access Control
Other
Potential Impacts:
Modify Memory
Dos: Crash, Exit, Or Restart
Execute Unauthorized Code Or Commands
Bypass Protection Mechanism
Other
Applicable Platforms
Languages:
Memory-Unsafe, C, C++
190
Integer Overflow or Wraparound
StableCommon Consequences
Security Scopes Affected:
Availability
Integrity
Confidentiality
Access Control
Other
Potential Impacts:
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Memory)
Dos: Instability
Modify Memory
Execute Unauthorized Code Or Commands
Bypass Protection Mechanism
Alter Execution Logic
Dos: Resource Consumption (Cpu)
Applicable Platforms
Languages:
Not Language-Specific, C
https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-cmfx…