MongoDB Atlas SQL CVE-2026-120952

Exploitation requires an authenticated database user with basic write privileges (PR:L) who can store a value of a particular database type whose textual form exceeds the fixed-width client-side target defined by the ODBC interface (this is the AT:P attack requirement). The consuming application must retrieve that value into a fixed-width bound target through the driver for the over-long copy to occur. Limiting factors: write-level database authentication is mandatory; the specific type-plus-fixed-width-retrieval condition must be met rather than any arbitrary query; and the realistic outcome is termination of the client application (availability), with the attacker able to influence only part of the data written outside the target, which constrains escalation beyond a crash.

This is a moderate-severity, moderate-priority issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 score is 6.0 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N: although the attack vector is network (AV:N), exploitation requires low privileges (PR:L - an authenticated database user with write access) and carries a specific attack requirement (AT:P - a value of a particular database type must be retrieved into a fixed-width client-side target), both of which meaningfully constrain real-world abuse. The impact profile is dominated by availability loss (VA:H, i.e. the consuming application crashes) with only low integrity impact (VI:L, the attacker influences part of the out-of-bounds data) and no confidentiality impact (VC:N); despite the CWE-787 out-of-bounds write / memory-corruption classification, the signals point to a denial-of-service against the client application rather than demonstrated code execution. The vuln.today decision label is 'this_month', not act_now or emergency. There is no CISA KEV listing, no EPSS score provided in the input, and no public exploit or PoC reference (the two references are a MongoDB changelog and a MongoDB Jira ticket, i.e. vendor tracking, not exploit code), so there is no public exploit identified at time of analysis. Net: a genuine but non-urgent issue - schedule remediation within the normal patch cycle; the combination of required write privileges, the specific retrieval condition, and availability-only impact keeps real-world risk below what the network vector alone might suggest.

An authenticated database user holding basic write privileges stores a value of a particular database type whose textual representation is longer than the fixed-width target that the client application has bound through the ODBC interface. When the application later retrieves that value, the Atlas SQL ODBC Driver copies the oversized text past the target buffer, corrupting memory and causing the consuming application to terminate unexpectedly. No public exploit code has been identified for this issue.