CVE-2026-19001 PUBLISHED

MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names

Assigner: mongodb
Reserved: 05.08.2026 Published: 12.08.2026 Updated: 13.08.2026

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
CVSS Score: 9.5

Product Status

Vendor MongoDB
Product BI Connector ODBC Driver
Versions Default: unaffected
  • affected from 1.0.0 to 1.4.9 (excl.)

References

Problem Types

  • CWE-190: Integer overflow or wraparound CWE