A memory‑handling error in the MongoDB Atlas SQL ODBC Driver causes values returned for a query to be written outside the bounds of a buffer that the calling application supplies. The flaw occurs when the driver ignores SQLBindCol’s BufferLength parameter and treats the buffer as a fixed‑width row array, so that a specific query requesting several rows at once can overflow the buffer. An attacker who can influence the query result set may cause data to be placed at unintended locations in the client application's memory, potentially modifying that memory or terminating the process.

The vulnerability exists in the MongoDB Atlas SQL ODBC Driver used by MongoDB Atlas applications. No specific product versions are identified in the CVE record, so any deployment of the driver that has not been updated by MongoDB is at risk.

The CVSS score of 2.1 indicates a low severity assessment, and the EPSS score is not available, with no listing in CISA KEV. Exploitation requires the attacker to influence query results and trigger bulk row fetching, which limits the likelihood of attack but still allows out‑of‑bounds memory writes that could lead to data corruption or process crashes. The overall risk is therefore low to moderate, depending on the application's use of the driver.