psqlODBC 18.00.0005 fixes heap corruption from oversized parameter lists

psqlODBC 18.00.0005 fixes heap corruption from oversized parameter lists

14 October 2026: The psqlODBC team has released version 18.00.0005 of the official PostgreSQL ODBC driver to fix CVE-2026-109448, a heap memory corruption bug triggered when an application binds more than 32,767 parameters on one statement. It is rated medium, CVSS 3.1 base score 5.9, and affects every release from 08.01.0102 through 18.00.0004. The team says all users should upgrade.

Where the memory goes wrong

SQLBindParameter accepts parameter numbers from 1 to 65,535, but the driver kept the count of bound parameters in a signed 16-bit field. Binding parameter 32,768 wraps that count to -32,768. Binding the next one makes the driver grow its binding arrays and zero-fill them starting from that negative index, writing about 2.5 MB of zeros that begin 1.25 MB before the allocation.

What happens next depends on the memory allocator. The advisory says glibc builds abort with realloc(): invalid next size, standard Windows builds fail with an access violation, and other allocators, including the Windows mimalloc builds, may keep running on a corrupted heap and crash later. At exactly 32,768 parameters nothing is corrupted, but execution fails with SQLSTATE 07002 even though every parameter was bound.

Which applications are exposed

Few applications bind tens of thousands of parameters on purpose. The realistic exposure is code that lets outside input decide how many it binds, the common case being an IN (?, ?, ...) list built from a user-supplied set of IDs, filters or uploaded values. An attacker who can submit a long enough list can crash that application, and on allocators that do not abort it may carry on with corrupted memory. The rating reflects availability impact only.

ODBC is often several layers down: reporting tools, ETL jobs, Excel and Access front ends, and older line-of-business applications on Windows reach PostgreSQL through it without the team that owns them thinking of it as a dependency.

The fix and what it changes

From 18.00.0005, SQLBindParameter rejects parameter numbers above 32,767 with SQLSTATE 07009. ODBC itself cannot describe more than 32,767 parameters, because its count fields are 16-bit, and no earlier driver could actually run such a statement, so the team says the change breaks no application that worked before.

The release fixes two bugs as well: server-prepared statements with 1,000 or more parameters could fail with truncated type names, and since 18.00.0003 bytea parameters failed through Microsoft's OLE DB Provider for ODBC, for example from ADO. Windows packages are now built with OpenSSL 3.5.9.

If the upgrade has to wait

The advisory gives two workarounds: cap the number of parameters an application builds from external input, or pass long value lists as a single array parameter, such as = ANY(?). The team credits Richard Kuesters with the report.

Related on TrustList:

• PgBouncer 1.26.1 fixes a SCRAM login bypass and two hang bugs
• PostgreSQL 19 now due on 19 November after late feature reverts
• DigitalOcean caps PostgreSQL and MySQL Standard Edition at 4 GiB RAM and drops standby nodes: 15 October for new accounts, 30 November 2026 for all

Sources

• PostgreSQL news: psqlODBC 18.00.0005 released with security fix for CVE-2026-109448, 14 October 2026
• psqlODBC: GitHub security advisory GHSA-cmfx-rm3r-p2jr, 12 October 2026