EUVD-2026-57602
GHSA-g4wv-p89v-7p3f
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N for network-delivered malformed server response, AC:H for required server control or MitM position, UI:R for active client connection initiation, S:C because memory corruption impacts the host application beyond the driver component.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
4DescriptionCVE.org
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.
AnalysisAI
Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potential code execution when the driver processes malformed stored procedure parameter metadata returned by a malicious or compromised server. The root cause is a missing bounds check (CWE-120) on the parameter size field in the metadata parsing routine, affecting all versions prior to v1.4.9. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to either (1) control the MongoDB BI Connector server that the ODBC driver is configured to connect to, or (2) be positioned on the network to intercept and forge server responses in transit (man-in-the-middle). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.8 reflects severe potential impact but is substantially qualified by the attack complexity and prerequisite signals in the vector (AV:N/AC:H/AT:P/PR:N/UI:A). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the MongoDB BI Connector ODBC Driver to version v1.4.9 or later, available at https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9; the release explicitly resolves CVE-2026-19002 with bounds clamping on parameter size fields. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems and applications running the MongoDB BI Connector ODBC Driver and document current versions to assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bi Connector Odbc Driver
View allMemory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process terminatio
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrit
Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the
Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the cli
Stack-based buffer overflow in MongoDB BI Connector ODBC Driver allows an authenticated user who can influence the numer
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today