An application using the MongoDB BI Connector ODBC Driver may encounter a memory‑safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The driver copies the digit sequence into a fixed‑size internal buffer without verifying the length, which can lead to a host application process termination or corruption of surrounding memory. This vulnerability can potentially allow an attacker who can influence the numeric portion of a LIMIT clause to cause a crash, or, if the corrupted memory can be crafted, to execute arbitrary code within the process.

The vulnerability affects the MongoDB:BI Connector ODBC Driver across all versions that enable the optional prefetch feature. Because the issue is tied to prefetch, any deployment that turns prefetch on is at risk. The exact affected driver releases are not listed; users should consult the vendor release notes and apply any available patch.

The CVSS score of 6.0 indicates moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The attack vector is likely application‑level: an attacker needs the ability to supply or manipulate the LIMIT clause in a SQL statement passed to the driver. If such influence is possible, the driver can be forced to overflow its internal buffer, leading to an application crash or potential arbitrary code execution depending on the memory state. The prefetch setting must be enabled for exploitation to succeed, so disabling this option reduces the risk until a patch is applied.