CVE-2026-19004

HIGH

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-19004 has a selected CVSS score of 8.8 (high).

Description

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

BI Connector ODBC Driver

Browse MongoDB / BI Connector ODBC Driver

Default status: unaffected

CVE List1.0.0 to < 1.4.9affected

References

2