CVE WatchNov 2, 2026

CVE-2026-120064

Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol wit

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 2, 2026 · Last modified: Nov 2, 2026 · CWE-129 · CWE-190

EPSS · 30d

Not enough EPSS history yet.

Technical description

Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.

Official references

github.comhttps://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-7pq2-q7mj-ph8c

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1204397.0 HIG

—

———QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.6h CVE-2026-1204387.8 HIG

—

———QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.6h CVE-2026-1204367.8 HIG

—

———Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.7h CVE-2026-1204327.8 HIG

—

———Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row buffer indices to cause crashes or potential code execution.7h CVE-2026-100140—

—

———An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.7h CVE-2026-107457—

—

——0A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.6h