psqlODBC versions before 18.00.0006 have a vulnerability in handling updatable cursors over tables without OIDs that have an auto-increment int4 column. The driver improperly escapes column names containing double quotes, which can alter SQL statements executed with the application's privileges. This allows a database user who can create tables read by the application to influence which rows are affected by positioned UPDATE or DELETE statements.