psqlODBC 18.00.0005 released with security fix for CVE-2026-109448

Brief written by the FOSSWire AI editor from PostgreSQL How we write

October 14, 2026 1 min read 65 reads

Key Takeaway

The official PostgreSQL ODBC driver release fixes a heap memory corruption vulnerability occurring when binding more than 32,767 parameters.

Summary

The psqlODBC team has released version 18.00.0005 to address CVE-2026-109448, a medium-severity vulnerability. The flaw involved heap memory corruption when an application bound more than 32,768 parameters due to the use of a signed 16-bit field. This release also fixes bugs related to type name truncation and bytea parameter handling in Microsoft's OLE DB Provider.

Technical details of the memory corruption fix

CVE-2026-109448: The driver used a signed 16-bit field for bound parameters; exceeding 32,768 parameters caused the driver to write zeros outside the intended memory bounds.
Mitigation: SQLBindParameter now returns SQLSTATE 07009 for parameter counts exceeding 32,767.
Bug Fix: Resolved an issue where type names were truncated after the 1,000th parameter due to a fixed-size buffer constraint.
Bug Fix: Fixed "Type is invalid" errors for bytea parameters when using Microsoft's MSDASQL provider.
Windows Update: Packages now utilize OpenSSL 3.5.9.

Why it matters

Users of the official PostgreSQL ODBC driver should upgrade immediately, especially if applications accept untrusted input to determine the number of parameters in SQL statements.

Original reference: www.postgresql.org →