# PostgreSQL ODBC driver update fixes parameter-binding memory corruption

_Published Thursday, October 15, 2026 at 9:21 AM EDT · Security · Latest · Tier 2 — Notable_

The psqlODBC team released version 18.00.0005 to fix a memory corruption vulnerability in PostgreSQL's official ODBC driver and urged all users to upgrade. Versions 08.01.0102 through 18.00.0004 are affected; the vulnerability has a CVSS 3.1 base score of 5.9, rated Medium.

Binding more than 32768 parameters to one statement could make the driver write zeros outside its parameter-binding memory, crashing the application or leaving it running with corrupted memory. Applications are exposed when untrusted input determines the number of parameters.

The update rejects parameter numbers above 32767. Users unable to upgrade can limit parameters derived from external input or pass long value lists as a single array parameter.

## Sources

- [PostgreSQL news](https://www.postgresql.org/about/news/psqlodbc-18000005-released-with-security-fix-for-cve-2026-109448-3404/)

---
Canonical: https://techandbusiness.org/newswire/hA4NB1CG5yvCBtlwqKp64b
Published: 2026-10-15T13:21:59.943Z
Story chronology: 2026-10-14T00:00:00.000Z
Retrieved: 2026-10-15T15:42:51.098Z
Publisher: Tech & Business (techandbusiness.org)