The MongoDB BI Connector ODBC Driver contains a classic buffer overflow in a metadata‑retrieval routine. When an application supplies a catalog, schema, or object name that exceeds the fixed buffer size, the driver writes past the buffer, corrupting memory inside the calling process. This memory corruption can terminate the process or, under certain conditions, allow an attacker to execute arbitrary code, making it a stateless memory safety vulnerability categorized as CWE‑190.

All systems running the MongoDB BI Connector ODBC Driver before a vendor‑issued fix are affected. Applications that invoke the driver to retrieve database metadata and that do not enforce limits on the length of catalog, schema, or object names are susceptible. No specific version range is supplied, so any release without the patch is potentially vulnerable.

A CVSS score of 9.5 signals critical severity. Because no EPSS data is available, the exact likelihood of exploitation is uncertain. The vulnerability is not listed in CISA KEV. The likely attack vector is an ODBC metadata request sent by an application that can be persuaded to supply an overly long name; the attacker does not need elevated privileges beyond those of the application user. Successful exploitation would lead to memory corruption and possibly arbitrary code execution within the host process.