ZeroDay Findings
Sign inSign up

Every 24 hours

Tech News

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Oct 14, 2026

    New psqlODBC Release Addresses Critical Security Vulnerability

    The psqlODBC team has announced the release of version 18.00.0005, which addresses a significant security vulnerability identified as CVE-2026-109448, alongside fixing two additional bugs. This update is crucial for all users of the official ODBC driver for PostgreSQL, as the identified vulnerability could lead to heap memory corruption when applications attempt to bind more than 32,767 parameters in a single SQL statement. The CVSS 3.1 base score for this vulnerability is rated at 5.9, indicating a medium level of severity.

    What changed

    The vulnerability arises from the way psqlODBC stores the number of bound parameters in a signed 16-bit field. If an application binds more than the stipulated limit, the driver may overwrite memory, potentially causing crashes or corrupting the application's operation. This issue particularly affects applications that allow untrusted inputs to dictate the number of parameters, such as those dynamically generating SQL statements.

    Who is affected

    With the release of version 18.00.0005, the psqlODBC driver now rejects attempts to bind more than 32,767 parameters, effectively mitigating the risk of memory corruption associated with this vulnerability. Users are strongly advised to upgrade to the latest version to ensure their applications remain secure. For those unable to upgrade immediately, it is recommended to limit the number of parameters sourced from external inputs or to utilize alternative methods for passing long value lists.

    What it means

    The psqlODBC team has acknowledged Richard Kuesters for reporting this issue, highlighting the importance of community involvement in identifying and resolving security concerns. As cyber threats continue to evolve, maintaining updated software and adhering to best practices in application security is essential for protecting sensitive data and ensuring system integrity.

  2. Oct 14, 2026

    Microsoft Addresses Vulnerability in Multiple Products

    A newly identified vulnerability, designated CVE-2026-88175, has been discovered affecting several Microsoft products, including Office 2021, Microsoft 365, and various 365 applications. With a CVSS score of 6.5, this vulnerability is categorized as medium risk, which suggests that while it may not pose an immediate severe threat, it still requires attention from users and organizations utilizing these platforms.

    What changed

    The vulnerability potentially impacts a wide range of users, from individual consumers to large enterprises relying on Microsoft’s suite of productivity tools. Given the extensive use of Microsoft products in both personal and professional environments, the implications of this vulnerability could be significant, affecting data integrity and user privacy if exploited.

    Who is affected

    Organizations utilizing Microsoft 365 and Office products are advised to stay vigilant and implement best practices in security. This includes ensuring that software is up-to-date, as patches and updates are likely to be released in response to this vulnerability. Failure to address such vulnerabilities could leave systems open to attacks that may compromise sensitive information.

    What it means

    As Microsoft works on a resolution, users should remain informed about any updates or patches provided by the company. The proactive response to vulnerabilities is crucial in maintaining security and trust in digital tools, especially those that play a vital role in everyday business operations.