The driver converts floating point column values into text without bounds checking. When an application reads a sufficiently large floating point value as text, the driver may write past the allocated buffer and corrupt adjacent memory. This buffer overflow can cause the BI Connector process to crash, and the vulnerability description indicates that an attacker who can store data in a collection read through the BI Connector could force the application performing the read to fail. No evidence of arbitrary code execution is provided; the impact is limited to memory corruption and a denial of service.

The flaw affects the MongoDB BI Connector ODBC Driver. The advisory for release v1.4.9 is cited, suggesting that earlier releases (v1.4.8 and earlier) contain the defect. Any deployment of the BI Connector older than v1.4.9 is potentially vulnerable. No specific version range is explicitly listed beyond this indirect reference.

The CVSS score of 7.1 reflects high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a native application using the ODBC driver; an attacker who can insert a sufficiently large floating point value into a collection that the BI Connector reads from can trigger the overflow and crash the driver. This presents a denial‑of‑service risk with potential memory corruption. The overall risk is moderate to high for environments that allow write access to the BI Connector’s data source.