An out-of-bounds write occurs in the MongoDB Atlas SQL ODBC Driver when it copies a textual representation of a database value that exceeds the size of the SQL_C_GUID target. The driver fails to truncate or limit the copy, allowing 32 additional bytes to be written past the allocated 16‑byte buffer. This overflow corrupts memory in the host application, which can then crash or terminate unexpectedly. A database user with basic write privileges can influence the content that ends up written beyond the buffer, potentially shaping the corruption.

The flaw affects any installation of the MongoDB Atlas SQL ODBC Driver that has not applied the vendor’s fix. All client systems that use the driver to fetch values of the vulnerable type are at risk. Currently the CVE entry does not list specific driver revisions, so administrators should review the driver version in use against the vendor’s changelog referenced above.

The CVSS score of 6.0 classifies the vulnerability as medium severity. With no EPSS value available and the vulnerability not listed in the CISA KEV catalog, the likelihood of widespread exploitation remains uncertain. Nevertheless, because the exploit requires only ordinary database write access and a standard driver installation, any attacker who can write to the database can trigger a denial-of-service condition in the consuming application.