psqlODBC receives large‑object data from the server and copies it into the client’s buffer using the length supplied by the server, but it does not verify that this length fits into the buffer. An attacker controlling the server, or a man‑in‑the‑middle that can inject server responses, can send data that exceeds the buffer size. The overrun overwrites adjacent memory with attacker‑chosen bytes, which can crash the client or lead to other unintended behavior. Accordingly, the vulnerability represents a classic buffer overflow that can compromise confidentiality, integrity, and availability of the client process.

All installations of PostgreSQL’s psqlODBC driver older than version 18.00.0006 are affected. The vulnerability is present regardless of the PostgreSQL server version; the critical requirement is that the client uses a vulnerable psqlODBC build. The exploit is triggered simply by fetching any large‑object (lo) column, so any application that performs such a read from a server it does not fully trust is at risk.

The CVSS score is 7.5, indicating a high severity. EPSS information is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting it has not been widely exploited in the wild as of the latest data. The attack vector is inferred: a remote attacker who can cause the client to request a large‑object from a server they can influence—such as by compromising the server or positioning themselves as a trusted MITM—can trigger the overflow. The attacker does not need to reach the client’s memory directly; manipulating the data sent by the server is sufficient. Because the overflow occurs during normal operation (any lo column read), the risk to users depends largely on whether the client connects to untrusted or MITM‑prone PostgreSQL servers.