EUVD-2026-57602
GHSA-g4wv-p89v-7p3f
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N for network-delivered malformed server response, AC:H for required server control or MitM position, UI:R for active client connection initiation, S:C because memory corruption impacts the host application beyond the driver component.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
4DescriptionCVE.org
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.
AnalysisAI
Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potential code execution when the driver processes malformed stored procedure parameter metadata returned by a malicious or compromised server. The root cause is a missing bounds check (CWE-120) on the parameter size field in the metadata parsing routine, affecting all versions prior to v1.4.9. No public exploit code or active exploitation has been identified at time of analysis, and MongoDB has released a fix in v1.4.9.
Technical ContextAI
The MongoDB BI Connector ODBC Driver (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*) is a translation layer that enables SQL-based BI tools to query MongoDB data via the ODBC interface by communicating with the MongoDB BI Connector server. When the driver receives metadata describing stored procedure parameters from the server, it copies those parameter fields into a fixed-size buffer without first validating that the supplied size fits within the allocation - a classic CWE-120 buffer overflow (buffer copy without checking size of input). The v1.4.9 release notes confirm the fix as 'Added logic to clamp parameter size for client app integrations,' establishing that the server-supplied parameter size value was previously trusted unconditionally. Because the corruption occurs inside the ODBC driver running in the client application's own process space, the affected memory region and severity of impact depends on the client application's memory layout at the time of parsing.
RemediationAI
Upgrade the MongoDB BI Connector ODBC Driver to version v1.4.9 or later, available at https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9; the release explicitly resolves CVE-2026-19002 with bounds clamping on parameter size fields. If immediate patching is not feasible, restrict all ODBC driver connections to trusted, network-isolated MongoDB BI Connector servers using firewall rules or host-based controls so that the driver cannot be directed at or intercepted by a rogue server - this directly removes the AT:P precondition required for exploitation. Enforcing mutual TLS authentication between the ODBC driver and the BI Connector server mitigates the man-in-the-middle interception vector; the trade-off is added certificate management overhead. Disabling stored procedure metadata queries is not a viable workaround as it would break core driver functionality for BI integrations.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today