MongoDB Atlas SQL EUVD-2026-116214

Two concrete conditions must both hold: (1) an attacker must be able to influence the values a query returns (e.g., control over the queried data), and (2) the calling application must use a specific application-chosen way of requesting several result rows at once (bulk/array row retrieval) - per the description, 'reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.' Exploitation is further limited by PR:L (some privilege required), UI:P (passive user interaction / an action by the victim application user), and AT:P (a non-default usage pattern must be present). Applications that do not use the multi-row bulk-fetch pattern are not exposed. Impact is confined to the client application's memory (no confidentiality loss; only limited integrity modification or client-process termination).

This is a genuinely low-priority issue, and the available signals agree rather than conflict. The vendor-assigned CVSS 4.0 score is 2.1 (Low) with vector AV:N/AC:L/AT:P/PR:L/UI:P and only partial integrity/availability impact (VI:L/VA:L, VC:N) - meaning no confidentiality loss and limited integrity/availability effect confined to the client process. The vuln.today decision label is 'monitor', the weakest urgency tier. The input provides no EPSS score, is not listed in CISA KEV, and shows no proof-of-concept or exploit reference (the two references are a MongoDB changelog and a Jira tracking ticket, neither of which is exploit code). Critically, exploitation is not remote-unauthenticated despite AV:N: it requires low privileges (PR:L), passive user interaction (UI:P), and a present attack requirement (AT:P) - the flaw only triggers when the client application uses a specific application-chosen method of fetching several result rows at once, and when an attacker can influence the values a query returns. This is a client-side ODBC driver defect, not a server-exposed service, so the attack surface is narrow. No key data is contradictory; the main gap is that EPSS and any fixed-version identifier are absent from the provided input.

An attacker who can influence the values a query returns (for example, by controlling data stored in an Atlas collection that a victim application later reads) waits for a client application that fetches multiple result rows at once using the specific affected request pattern. When that application retrieves the attacker-influenced rows, the driver writes returned values outside the caller-provided buffer, corrupting client-process memory or crashing it. No public exploit code or PoC is identified at time of analysis.