MongoDB BI Connector CVE-2026-19001

Exploitation requires the vulnerable driver (any version before v1.4.9) to invoke an ODBC metadata retrieval/catalog function (e.g., SQLTables, SQLColumns, SQLPrimaryKeys) that receives an unusually long catalog, schema, or object name. The name must be long enough to overflow the fixed-size buffer, and reliable arbitrary code execution occurs only 'under certain conditions' (favorable heap/stack layout) - otherwise the result is an application crash. Limiting factors: the oversized name must actually reach the vulnerable function, which realistically means a malicious/compromised database server, a crafted application query, or MITM-injected metadata rather than a trivial remote hit; the vendor rates attack complexity High (AC:H); and hosts already on v1.4.9 are not exploitable. Authentication requirements are not independently confirmable beyond the vendor CVSS PR:N.

Signals are mixed. The vendor CVSS 4.0 base score is 9.5 (Critical) with AV:N/AC:H/AT:N/PR:N/UI:N and full VC/VI/VA plus subsequent-system SC:H/SI:H, but that scope-change claim is questionable: the description explicitly scopes impact to 'the calling application's process,' which argues for no cross-system scope change. The description also says code execution is only possible 'under certain conditions,' matching the AC:H rating and meaning most real-world triggers likely yield a crash (DoS) rather than reliable RCE. There is a genuine attack-vector ambiguity - the write is triggered by input 'an application supplies,' so remote (AV:N) exploitation realistically depends on a malicious or compromised database server (or MITM) feeding oversized metadata names, rather than a purely unauthenticated internet-facing attack; verify the true input source with the vendor. No EPSS score, KEV entry, or POC is present in the provided data, so despite the 9.5 rating this reads as a high-severity-but-unproven-exploitability issue that is a solid patch priority for anyone running the driver, but not evidence of active exploitation.

An attacker who controls or has compromised a MongoDB/BI Connector endpoint (or can MITM the connection) returns metadata containing an extremely long catalog, schema, or object name; when the victim's BI tool calls a driver catalog function to enumerate schema, the oversized name overflows a fixed-size buffer and corrupts process memory. In most cases this crashes the client application, but under favorable memory layout it can be leveraged for arbitrary code execution in the application's process. No public POC or exploit code was identified at time of analysis.