postgresql-interfaces/psqlodbc REL-18_00_0005

psqlODBC 18.00.0005

on GitHub

psqlODBC 18.00.0005 is a security and bug-fix release. All users should upgrade.

Security

CVE-2026-109448: heap memory corruption when binding more than 32767 parameters (GHSA-cmfx-rm3r-p2jr, CVSS 3.1 5.9, Medium)

The driver stored the number of bound parameters in a signed 16-bit field. Binding parameter 32769 or above on one statement wrote zeros outside the binding array, which crashes the application or leaves it running on a corrupted heap. Applications are exposed if they let untrusted input decide how many parameters they bind, for example by building an IN (?, ?, ...) list from user-supplied values. All releases from 08.01.0102 to 18.00.0004 are affected.

SQLBindParameter now rejects parameter numbers above 32767 with SQLSTATE 07009 (invalid descriptor index). 32767 is also the largest parameter count ODBC can report, because SQLNumParams and SQL_DESC_COUNT are 16-bit. No earlier release could execute a statement with more than 32767 parameters, so no working application loses functionality.

Thanks to Richard Kuesters (@vltr) for finding and reporting this issue.

Bug fixes

• Fix server-side prepared statements with 1000 or more parameters failing with errors such as type "timestam" does not exist. From $1000 on, the cast written after each parameter placeholder was cut to 15 characters, so $1000::timestamp became $1000::timestam. (#221, by Richard Kuesters)
• Fix bytea parameters failing with "Type is invalid" through the MSDASQL OLE DB provider (ADO) since 18.00.0003. SQLGetTypeInfo now reports the largest column size for bytea instead of SQL_NO_TOTAL (-4). (#215, #218)

Build

• Build Windows packages against OpenSSL 3.5.9. (#219)

Downloads

• psqlodbc-setup.exe: installs the x86 driver, plus the x64 driver on 64-bit Windows.
• psqlodbc_x64.msi, psqlodbc_x86.msi, psqlodbc_arm64.msi: the driver for one architecture.
• psqlodbc_*.msm: merge modules for bundling the driver into your own installer.

A build that uses the mimalloc allocator is published separately as REL-18_00_0005-mimalloc (x86 and x64).

Full changelog: REL-18_00_0004...REL-18_00_0005