MongoDB Vulnerabilities and Affected Products
Vulnerabilities associated with BI Connector ODBC Driver.
Products
Clear product- MongoDB Server65 vulnerabilities
- mongodb9 vulnerabilities
- BI Connector ODBC Driver6 vulnerabilities
- Atlas SQL ODBC Driver2 vulnerabilities
- Schema Builder CLI2 vulnerabilities
- BSON::XS1 vulnerability
- C Driver1 vulnerability
- c\#_driver1 vulnerability
- c_driver1 vulnerability
- java_driver1 vulnerability
- Mongo-c-driver1 vulnerability
- mongo-express1 vulnerability
- MongoDB and MongoDB Server1 vulnerability
- MongoDB Compass1 vulnerability
- MongoDB Driver1 vulnerability
- mongodb_server1 vulnerability
- PHP Driver1 vulnerability
- Rust Driver1 vulnerability
- rust_driver1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-19003HIGH | MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settingsA data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process terminat… CWE-121Aug 12, 2026 | CVSS8.4v4.0 | EPSS0.126% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-19004HIGH | MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output ParametersAn application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution. CWE-122Aug 12, 2026 | CVSS8.8v4.0 | EPSS0.364% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18888HIGH | MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character dataThe MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read. CWE-787Aug 12, 2026 | CVSS7.1v4.0 | EPSS0.289% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-19001CRITICAL | MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object namesThe MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution. CWE-190Aug 12, 2026 | CVSS9.5v4.0 | EPSS0.377% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-19002HIGH | Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC DriverA missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code. CWE-120Aug 12, 2026 | CVSS8.8v4.0 | EPSS0.294% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12100HIGH | MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesIncorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6. CWE-276Oct 23, 2025 | CVSS8.8v4.0 | EPSS0.126% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |