CVE-2024-1013

unixODBC has an out-of-bounds stack write on 64-bit systems: a caller provides four bytes of space while the callee writes eight, so extra bytes spill past the buffer onto the stack. On little-endian architectures the overwrite may pass unnoticed; on big-endian ones it can break execution outright. This is a memory-safety defect in a library that sits underneath a great deal of database connectivity, reachable locally with only low privileges.

The impact hinges on where unixODBC is linked and how it's reached. It isn't a remote, unauthenticated exploit — the vector is local — but unixODBC is a foundational component that many applications pull in transitively to talk to databases, so the vulnerable code can be present far more widely than anyone deliberately installed it. Stack corruption of this kind ranges from crashes to potential control-flow hijack depending on how the flaw is driven.

This is fundamentally a dependency-inventory problem. The advisory is easy to read; the hard and valuable part is enumerating everything that links unixODBC — directly or pulled in by an application or container base image — and pinning versions against the fix. We rank the raw bug as a local memory-safety issue but weight it up for reach, because a library this deep in the stack turns a single unpatched package into a broad, quietly distributed exposure.