EUVD-2026-57607
GHSA-fjxq-47rx-gwhh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because attacker must control or impersonate the server; UI:R for required client-initiated connection; S:C because heap overflow in driver can affect the broader application process.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
4DescriptionCVE.org
An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.
AnalysisAI
Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application connect to an untrusted, attacker-controlled, or network-impersonated MongoDB BI Connector database server - the attacker must occupy the server role, not merely an intermediate network path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.8 reflects high potential impact (VC:H/VI:H/VA:H/SC:H/SI:H) but the high attack complexity (AC:H) and attack requirements (AT:P) materially reduce the realistic threat surface - successful exploitation demands that the attacker control or impersonate the database server the ODBC client connects to, a significant prerequisite that sharply limits opportunistic exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade the MongoDB BI Connector ODBC Driver to version 1.4.9 or later, which includes the 'logic to clamp buffers' that directly addresses CVE-2026-19004. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running MongoDB BI Connector ODBC Driver and catalog deployed versions across your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bi Connector Odbc Driver
View allMemory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potenti
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrit
Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the
Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the cli
Stack-based buffer overflow in MongoDB BI Connector ODBC Driver allows an authenticated user who can influence the numer
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today