An integer wraparound in the psqlODBC SQLBindParameter function causes the driver to store the binding count in a signed 16‑bit field. When a caller attempts to bind parameter 32768, the count wraps from 32767 to –32768, and binding parameter 32769 writes a large block of zeros starting ahead of the binding array. The resulting heap corruption can make the application crash or leave it running with corrupted heap structures. The flaw is a classic heap overflow (CWE‑124) and a signed overflow (CWE‑190).

All PostgreSQL psqlODBC drivers earlier than version 18.00.0005 are affected. The issue is isolated to the psqlODBC driver; the core PostgreSQL database is not impacted. Applications that build large parameter lists from external input—such as an IN (…) clause—are exposed, especially when they do not validate the number of parameters before binding.

The CVSS score of 5.9 indicates moderate severity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalogue. An attacker who can influence the number of parameters bound in a single statement can trigger the heap corruption by supplying more than 32,767 parameters. While the primary consequence is a crash or corrupted heap, the lack of input validation in affected applications increases the risk of exploitation in practice.