CVE-2026-109448

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109448
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109448.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109448
Aliases
  • GHSA-cmfx-rm3r-p2jr
Downstream
Published
2026-10-12T17:42:59Z
Modified
2026-10-13T02:47:15Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters
Details

Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.

Database specific 
{
    "cna_assigner":  "PostgreSQL",
    "cwe_ids":  [
        "CWE-124",
        "CWE-190"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109448.json"
}
References

Affected packages

Git / github.com/postgresql-interfaces/psqlodbc

Affected ranges

Type
GIT
Repo
https://github.com/postgresql-interfaces/psqlodbc
Events
Introduced
2965228ee5b7cdb606516c9d436106dafacea020
Fixed
f6da5647355b110fc9cc005100e23ba980e20e33
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "08.01.0102"
        },
        {
            "fixed":  "18.00.0005"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
REL-08_01_0102
REL-08_01_0200
REL-08_02_0100
REL-08_02_0200
REL-08_02_0300
REL-08_02_0400
REL-08_03_0100
REL-08_03_0200
REL-08_03_0300
REL-08_03_0400
REL-08_04_0100
REL-08_04_0200
REL-09_00_0100
REL-09_00_0101
REL-09_00_0200
REL-09_00_0300
REL-09_00_0310
REL-09_01_0100
REL-09_01_0200
REL-09_02_0100
REL-09_03_0100
REL-09_03_0200
REL-09_03_0210
REL-09_03_0300
REL-09_03_0400
REL-09_05_0100
REL-09_05_0200
REL-09_05_0210
REL-09_05_0300
REL-09_05_0400
REL-09_06_0100
REL-09_06_0200
REL-09_06_0300
REL-09_06_0310
REL-09_06_0400
REL-09_06_0410
REL-09_06_0500
REL-10_00_0000
REL-10_01_0000
REL-10_02_0000
REL-10_03_0000
REL-11_00_0000
REL-11_01_0000
REL-12_00_0000
REL-12_01_0000
REL-12_02_0000
REL-13_00_0000
REL-13_01_0000
REL-13_02_0000
REL-15_00_0000
REL-16_00_0000
REL-16_00_0003
REL-16_00_0004
REL-16_00_0005
REL-16_00_0005-mimalloc
REL-16_00_0006
REL-16_00_0006-mimalloc
REL-16_00_0007
REL-16_00_0007-mimalloc
REL-17_00_0000
REL-17_00_0000-mimalloc
REL-17_00_0001
REL-17_00_0001-mimalloc
REL-17_00_0002
REL-17_00_0002-mimalloc
REL-17_00_0003
REL-17_00_0003-mimalloc
REL-17_00_0004
REL-17_00_0004-mimalloc
REL-17_00_0005
REL-17_00_0005-mimalloc
REL-17_00_0006
REL-17_00_0006-mimalloc
REL-17_00_0007
REL-17_00_0007-mimalloc
REL-17_00_0008
REL-17_00_0008-mimalloc
REL-17_00_0009
REL-17_00_0009-mimalloc
REL-17_00_0010
REL-17_00_0010-mimalloc
REL-18_00_0000
REL-18_00_0000-mimalloc
REL-18_00_0001
REL-18_00_0001-mimalloc
REL-18_00_0002
REL-18_00_0002-mimalloc
REL-18_00_0003
REL-18_00_0003-mimalloc
REL-18_00_0004
REL-18_00_0004-mimalloc

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109448.json"