MongoDB BI Connector ODBC CVE-2026-81532

The attacker must have low-privilege authenticated access to submit arbitrary SQL through an application that uses the MongoDB BI Connector ODBC driver - confirmed by CVSS PR:L. Specifically, the attacker must be able to issue a positioned-cursor SQL construct (a DECLARE CURSOR statement followed by a positioned UPDATE or DELETE referencing that cursor) with a cursor name whose length exceeds the driver's internal fixed-length buffer. Environments that restrict end-user SQL to pre-approved parameterized queries, stored procedures, or query builders that do not expose raw positioned-cursor syntax are not exploitable via this path, though the trade-off is loss of ad-hoc SQL flexibility. Exploitation is limited to the ODBC driver host process (no scope change); the attacker cannot directly pivot to other systems through this vulnerability alone. Operating systems with robust stack protection (stack canaries, shadow stacks) and full ASLR/DEP enforcement will degrade exploitation from code execution to reliable denial of service, though crash-loop exploitation may still be useful for disruption.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, score 8.7) signals a network-reachable, low-complexity flaw requiring only low-privilege SQL access - a realistic bar in BI environments where analysts routinely write ad-hoc queries. The PR:L authentication requirement provides a meaningful but low barrier: any user with a valid ODBC data-source login can trigger the overflow. Scope is bounded to the ODBC driver host process (SC:N/SI:N/SA:N), limiting lateral blast radius. No EPSS score was supplied and this CVE does not appear in CISA's KEV catalog, nor is POC code publicly documented, so no confirmed active exploitation exists at time of analysis. The absence of exploitation evidence moderates urgency, but the low attack complexity and potential for code execution mean that organizations of any size - even those running a single BI server - should treat this as a prioritized patch rather than a deferred maintenance item, particularly because BI Connector deployments often operate with elevated database read privileges.

An analyst authenticated to a corporate BI platform (e.g., Tableau Server connected via ODBC to MongoDB) crafts a positioned-cursor DELETE statement with a cursor name several hundred bytes long and submits it through the application's query interface. The ODBC driver copies the name into its fixed diagnostic buffer without bounds checking, overwriting adjacent stack frames. In environments without stack canaries or with ASLR weaknesses, this can redirect execution to attacker-controlled shellcode or ROP chain within the BI Connector process; at minimum, it reliably crashes the service, causing a denial of service for all connected users.