A missing bounds check in the MongoDB BI Connector ODBC Driver when parsing stored procedure parameter metadata allows an attacker who can control the server or supply responses to the driver to cause an out‑of‑bounds write in the client process. This memory corruption can crash the application or, under certain conditions, lead to execution of unintended code, potentially compromising the host on which the driver runs. The flaw constitutes a CWE-120 buffer overrun vulnerability.

All installations of the MongoDB BI Connector ODBC Driver are potentially affected. The flaw exists in versions prior to 1.4.9; upgrading to that release or newer removes the issue. Administrators should verify their current driver version and apply the update promptly.

The CVSS score of 8.8 indicates high severity, and the EPSS score is not available, but the absence of a KEV listing does not reduce the potential risk. An attacker would need control over the MongoDB server or the ability to impersonate it, suggesting the attack is limited to environments where the driver connects to an untrusted or compromised server. Once malicious metadata is delivered, the unbounded write can lead to service disruption or code execution, making this a serious threat for any application relying on the driver.