psqlODBC 18.00.0005 released with security fix for CVE-2026-109448

The psqlODBC team has released version 18.00.0005 of psqlODBC, the official ODBC driver for PostgreSQL. This release fixes one security vulnerability and two bugs. All users should upgrade.

## Security issue

### CVE-2026-109448: heap memory corruption when binding more than 32767 parameters

CVSS 3.1 base score: 5.9 (Medium)

Versions affected: 08.01.0102 through 18.00.0004.

psqlODBC stored the number of bound parameters on a statement in a signed 16-bit field. When an application bound more than 32768 parameters on one statement, the driver wrote zeros outside the memory that holds the parameter bindings. The application could crash, or keep running with corrupted memory. An application is exposed if it lets untrusted input decide how many parameters it binds, for example by building an `IN (?, ?, ...)` list from user-supplied values.

`SQLBindParameter` now rejects parameter numbers above 32767 with SQLSTATE 07009. ODBC cannot report more than 32767 parameters, because `SQLNumParams` and `SQL_DESC_COUNT` are 16-bit values. No earlier release could run a statement with more than 32767 parameters, so this change does not break any application that worked before.

If you cannot upgrade right away, limit the number of parameters your application builds from external input, or pass long value lists as a single array parameter, for example `= ANY(?)`.

The psqlODBC team thanks Richard Kuesters for reporting this problem.

For more details, see the advisory [GHSA-cmfx-rm3r-p2jr](https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-cmfx-rm3r-p2jr).

## Bug fixes

- Statements prepared on the server with 1000 or more parameters could fail with errors such as `type "timestam" does not exist`. From parameter 1000 on, the driver cut the type name that follows each parameter to fit a fixed-size buffer.
- Since 18.00.0003, `bytea` parameters failed with "Type is invalid" when used through Microsoft's OLE DB Provider for ODBC (MSDASQL), for example from ADO.

The Windows packages are now built with OpenSSL 3.5.9.

## Download

Windows installers and merge modules for x86, x64 and ARM64 are available from the [PostgreSQL download site](https://www.postgresql.org/ftp/odbc/releases/REL-18_00_0005/) and from the [GitHub release page](https://github.com/postgresql-interfaces/psqlodbc/releases/tag/REL-18_00_0005). The source code is on [GitHub](https://github.com/postgresql-interfaces/psqlodbc).

The full list of changes is in the [release notes](https://github.com/postgresql-interfaces/psqlodbc/releases/tag/REL-18_00_0005).

Please report bugs on the [psqlODBC issue tracker](https://github.com/postgresql-interfaces/psqlodbc/issues) or the [pgsql-odbc mailing list](https://www.postgresql.org/list/pgsql-odbc/).