Vulnerability · Published Aug 28, 2026 · Assigned by mongodb
CVE-2026-81532BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption
High 8.8
In plain English
A high-severity stack buffer overflow in BI Connector ODBC Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | BI Connector ODBC Driver | 0 – before 1.4.10 |
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H