Atlas SQL ODBC CVE-2025-11575

Requires an attacker to already have local, authenticated low-privileged access to a Windows system that has the MongoDB Atlas SQL ODBC driver (version 1.0.0 through 2.0.0) installed. The core condition is the driver's incorrect default permissions (CWE-276): installation leaves driver files or directories writable/modifiable by non-administrative users, so a standard user can tamper with components that are later executed with higher privilege. Limiting factors that reduce real-world risk: exploitation is local-only (AV:L) with no network path, it needs a pre-existing low-privilege foothold (PR:L), it is Windows-specific, an attack requirement/precondition applies (AT:P), and it is bounded to the affected 1.0.0-2.0.0 driver range.

This is a credible but non-urgent local privilege-escalation issue. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) confirms the attacker must already have local, low-privileged access to the Windows host and that an attack requirement/precondition exists (AT:P), so this is not a remote or pre-authentication flaw despite the headline 8.8 score. CWE-276 (Incorrect Default Permissions) with full VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H indicates that successful exploitation yields full compromise of the host beyond the vulnerable component (i.e., escalation toward SYSTEM). The exploitation signals argue strongly against treating this as a widespread emergency: EPSS is only 0.13% (2nd percentile), there is no CISA KEV listing, and no public exploit has been identified in the provided data - exploitation status is 'no public exploit identified at time of analysis.' The high base score is driven by severe impact assuming a prior foothold, not by ease or breadth of attack. No key signals conflict, but note the SSVC/automatable and POC fields were not supplied, so weaponization potential cannot be independently assessed from the input.

A local, low-privileged user (or malware already running under a standard account) on a Windows machine with the MongoDB Atlas SQL ODBC driver installed abuses the driver's overly permissive default file/directory permissions to modify or replace a driver binary or resource that is later loaded or executed by a higher-privileged process. This grants the attacker elevated (up to SYSTEM) privileges. No public proof-of-concept is identified in the provided data, and the AT:P attack requirement means a specific precondition must be met.