psqlODBC allocates its row cache based on the column count of the first FETCH of a cursor. Later FETCH replies are used to recompute the column count without any validation. If an attacker can cause a cursor to return a later FETCH with a different count, the driver will overrun or underflow its allocated heap buffer, potentially corrupting memory and enabling arbitrary code execution. This vulnerability is reachable when UseDeclareFetch is enabled and the server is not trusted by the current SSL configuration, allowing the attacker to supply tailored responses.

The affected product is psqlODBC from PostgreSQL, with versions prior to 18.00.0006 vulnerable. The issue is limited to these older releases; newer releases contain a guard that rejects mismatched column counts and mitigates keyset replies with fewer columns than key fields.

The CVSS score of 7.5 indicates a high severity, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower probability of widespread exploitation. Exploitation requires an attacker who can influence the server’s responses, typical of untrusted or improperly secured database connections, and the cursor must be fetched with UseDeclareFetch enabled. If these conditions are met, the memory corruption could allow the attacker to execute arbitrary code on the client machine.