CVE-2026-19001

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9	Vendor Advisory Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El controlador ODBC de MongoDB BI Connector puede escribir fuera de los límites de un búfer de tamaño fijo cuyo una aplicación proporciona un nombre de catálogo, esquema u objeto inusualmente largo a una función de recuperación de metadatos. Esto puede resultar en corrupción de memoria dentro del proceso de la aplicación que realiza la llamada, lo que lleva a una terminación anormal y, bajo ciertas condiciones, al potencial de ejecución de código arbitrario.

Information

Published : 2026-08-12 21:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-19001

Mitre link : CVE-2026-19001

CVE.ORG link : CVE-2026-19001

JSON object : View

Products Affected

mongodb

bi_connector_odbc_driver

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-19001", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19001", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T12:55:24.710091Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"repo": "https://github.com/mongodb/mongo-bi-connector-odbc-driver", "vendor": "MongoDB", "product": "BI Connector ODBC Driver", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.4.9", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T21:17:37.307", "references": [{"url": "https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9", "tags": ["Vendor Advisory", "Release Notes"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution."}, {"lang": "es", "value": "El controlador ODBC de MongoDB BI Connector puede escribir fuera de los l\u00edmites de un b\u00fafer de tama\u00f1o fijo cuyo una aplicaci\u00f3n proporciona un nombre de cat\u00e1logo, esquema u objeto inusualmente largo a una funci\u00f3n de recuperaci\u00f3n de metadatos. Esto puede resultar en corrupci\u00f3n de memoria dentro del proceso de la aplicaci\u00f3n que realiza la llamada, lo que lleva a una terminaci\u00f3n anormal y, bajo ciertas condiciones, al potencial de ejecuci\u00f3n de c\u00f3digo arbitrario."}], "lastModified": "2026-10-23T19:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3A9AD1E-C6E1-4143-B62E-0E490521AB19", "versionEndExcluding": "1.4.9", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}