MongoDB BI Connector CVE-2026-19002

Exploitation requires the attacker to either (1) control the MongoDB BI Connector server that the ODBC driver is configured to connect to, or (2) be positioned on the network to intercept and forge server responses in transit (man-in-the-middle). The specific trigger is the driver receiving and parsing stored procedure parameter metadata - the client application must actively initiate a connection or query that causes this metadata to be processed, consistent with the CVSS 4.0 UI:A (active user interaction) metric. Limiting factors: a passive network observer or remote unauthenticated attacker with no server access cannot trigger the vulnerability; clients connecting exclusively to trusted, access-controlled BI Connector servers over authenticated and encrypted channels are not at risk without a separate server-side compromise.

The CVSS 4.0 base score of 8.8 reflects severe potential impact but is substantially qualified by the attack complexity and prerequisite signals in the vector (AV:N/AC:H/AT:P/PR:N/UI:A). The AC:H and AT:P metrics together indicate that exploitation is not straightforward: the attacker must either operate a malicious MongoDB BI Connector server that the victim driver connects to, or occupy a network-interception position to forge server responses - preconditions that rule out opportunistic mass exploitation and mean even a mid-sized municipal IT team in inowroclaw could meaningfully contain risk by simply restricting ODBC connectivity to trusted, network-isolated servers. The scope-change signals (SC:H/SI:H) indicate that if code execution is achieved within the client process, impact extends beyond the driver itself to the host application and potentially the underlying system. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified - this is a notable gap given the 8.8 score. No CISA KEV listing and no proof-of-concept code have been identified, suggesting exploitation is not currently observed in the wild. Risk prioritization should weight the AT:P server-control prerequisite heavily; environments where ODBC clients connect only to internal, hardened BI Connector instances face substantially lower practical exposure than environments with externally-reachable or shared servers.

An attacker who has compromised or controls the MongoDB BI Connector server - or can intercept the driver's network traffic via DNS hijacking, ARP spoofing, or a rogue server deployment - returns a crafted stored procedure parameter metadata response with an oversized parameter size field. The ODBC driver writes the server-supplied metadata into a fixed-size buffer without bounds validation, corrupting adjacent memory in the client application process. Depending on heap or stack layout within the consuming application, this results in abnormal termination or, under controlled memory conditions, arbitrary code execution within the client process context.