The vulnerability arises when a data source definition contains an over-length file path setting used in the MongoDB BI Connector ODBC Driver. Opening the setup dialog and initiating a file or folder selection causes the dialog to write beyond the allocated buffer due to an incorrect capacity calculation. This CWE-121 stack buffer overflow can lead to abnormal termination or, in some builds, execution of unintended code in the user’s process context. The flaw is local and requires an active user to open the dialog, but it may allow the attacker to leak memory contents or run arbitrary code with the same privileges.

The affected product is MongoDB:BI Connector ODBC Driver. The data does not specify a fixed version range, but the vulnerability is present in releases prior to the fix referenced in the driver’s release notes. Users should review the vendor’s changelog to determine if their installed version contains the buffer overflow bug.

The CVSS score of 8.4 classifies the issue as high severity. Because the attack requires local interaction with the setup dialog, the exploitability is medium; a malicious user who can run the driver process may craft a data source with an oversized path to trigger the overflow. The EPSS score is not available, and the vulnerability is not in the KEV catalog, suggesting no widely known exploits yet. Nevertheless, a buffer overflow that can lead to arbitrary code execution remains a significant risk, especially on systems where the driver runs under elevated privileges. Proper patching and safe configuration are therefore strongly advised.