Description
An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.
Published: 2026-08-12
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a memory‑safety flaw in the MongoDB BI Connector ODBC Driver. The driver mishandles output parameters returned by a stored procedure, potentially causing a null pointer dereference or similar failure. An attacker who can supply crafted metadata from an untrusted or impersonated database server can trigger the flaw, leading to process termination, exposure of in‑process memory, and in some circumstances arbitrary code execution. The weakness corresponds to CWE‑122: Heap‑based Buffer Overflow.

Affected Systems

MongoDB: BI Connector ODBC Driver. All installations of the driver that are older than the latest known release (tag v1.4.9) are vulnerable. No specific version range is listed, but the vulnerability applies to any driver used with an untrusted or impersonated database server that can return malicious metadata.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. EPSS score is not available, so the likelihood of exploitation is unknown, though the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to configure a database server that the application connects to, or to impersonate one, and to return crafted metadata during the execution of a stored procedure. No publicly available exploit code is known at this time, but the path to exploitation is clear. The vulnerability is fixed in the driver release v1.4.9.

Generated by OpenCVE AI on August 12, 2026 at 22:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the MongoDB BI Connector ODBC Driver to version v1.4.9 or later, which contains the remediation for this memory‑safety issue.
  • Restrict driver connections to trusted database servers using firewall rules or host‑based access control to prevent processing of untrusted metadata.
  • If immediate upgrade is not possible, validate or constrain the metadata returned by stored procedures against an expected schema, or disable execution of stored procedures that return output parameters.

Generated by OpenCVE AI on August 12, 2026 at 22:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb bi Connector Odbc Driver
Vendors & Products Mongodb
Mongodb bi Connector Odbc Driver

Wed, 12 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.
Title MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N'}

Subscriptions

Mongodb Bi Connector Odbc Driver
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-08-13T14:09:20.563Z

Reserved: 2026-08-05T19:46:33.537Z

Link: CVE-2026-19004

cve-icon Vulnrichment

Updated: 2026-08-13T14:09:17.311Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-12T21:17:37.577

Modified: 2026-08-28T21:16:15.740

Link: CVE-2026-19004

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:47:47Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow