Log in Start free

Vulnerability · Published Aug 12, 2026 · Assigned by mongodb

CVE-2026-19004MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters

High 8.1

In plain English

A high-severity heap buffer overflow in BI Connector ODBC Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 56.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

Affected products (as reported)

VendorProductVersions
MongoDB BI Connector ODBC Driver 1.0.0 – before 1.4.9

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References