EUVD-2026-57603
GHSA-qp3w-mm2v-5347
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N with AC:H because the oversized name realistically arrives via a malicious server and RCE only works 'under certain conditions'; PR:N/UI:N per vendor; S:U since impact stays within the calling process, contradicting the vendor's scope-change claim.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
4DescriptionCVE.org
The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.
AnalysisAI
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or object name is passed to a metadata retrieval/catalog function, overflowing a fixed-size buffer. This can crash the calling application and, under certain heap/stack conditions, lead to arbitrary code execution within that process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the vulnerable driver (any version before v1.4.9) to invoke an ODBC metadata retrieval/catalog function (e.g., SQLTables, SQLColumns, SQLPrimaryKeys) that receives an unusually long catalog, schema, or object name. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the MongoDB BI Connector ODBC Driver to v1.4.9 or later, which clamps name-length in the catalog functions (release: https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9); this single upgrade also remediates CVE-2026-18888/19002/19003/19004. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using MongoDB BI Connector ODBC Driver across your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bi Connector Odbc Driver
View allHeap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process terminatio
Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potenti
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrit
Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the
Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the cli
Stack-based buffer overflow in MongoDB BI Connector ODBC Driver allows an authenticated user who can influence the numer
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today