Vulnerability · Published Aug 12, 2026 · Assigned by mongodb
CVE-2026-19001MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names
Critical 9.8
In plain English
A critical-severity integer overflow in BI Connector ODBC Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Official description
The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | BI Connector ODBC Driver | 1.0.0 – before 1.4.9 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H