The vulnerability arises when psqlODBC builds SELECT, UPDATE, or DELETE statements for an updatable cursor over a table lacking OIDs that has an auto‑increment int4 column. It inserts the column name reported by the server into a printf‑style format string and expands it with a single argument. If the column name contains format directives, the driver reads unrelated memory, which can crash the client application or copy client memory into the SQL text sent to the server.

Affected systems are PostgreSQL installations that use the psqlODBC driver version 18.00.0006 or earlier. The issue exists in all releases prior to 18.00.0006 and applies to any database that can create an updatable cursor over a table with an auto‑increment int4 column.

The CVSS score is 6.8 and no EPSS data is available; the vulnerability is not listed in KEV. The attack requires an attacker who can influence a server‑supplied column name—either by connecting to a server whose SSL settings do not enforce trust or by creating a table as a database user. The exploit can lead to a crash or inadvertent disclosure of client memory within the query, potentially affecting application availability or confidentiality. Because the exploit relies on database schema manipulation and updatable cursors, the likelihood of exploitation is limited but not impossible in environments with lax database user permissions.