The vulnerability arises when a user submits a positioned‑cursor SQL statement through an application that uses the MongoDB Connector for BI ODBC driver. If the cursor name exceeds the size of an internal fixed‑length buffer, the driver incorrectly constructs its diagnostic message without bounding the name length, resulting in adjacent memory being overwritten. This memory corruption can terminate the hosting application process and, in some scenarios, enable unintended code execution within that process. The weakness is a classic stack-based buffer overflow (CWE‑121).

The affected product is the MongoDB:BI Connector ODBC Driver. No specific versions were supplied in the data; therefore, all releases prior to an identified fix are considered vulnerable. Users should verify that their deployed driver does not contain the overflow issue.

With a CVSS score of 8.7 the vulnerability is considered high severity, yet the EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector involves an application capable of sending arbitrary SQL statements through the driver; an attacker who can drive such input may trigger the overflow. Exploitation would require the attacker to supply a cursor name longer than the internal buffer, causing the driver to overwrite memory used by the application. While the description does not detail a publicly available exploit, the high severity and potential for code execution warrants proactive mitigation.