EUVD-2026-57605
GHSA-hcwq-44xg-qq4g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects the required MongoDB write access; A:H for deterministic application crash; no confidentiality or integrity impact applies.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
4DescriptionCVE.org
The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.
AnalysisAI
Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the client application performing data reads through the connector. The driver fails to validate destination buffer size when converting floating-point column values to their string representations, enabling memory corruption when sufficiently large float values are encountered. No public exploit code has been identified at time of analysis, and a vendor-confirmed fix is available in version 1.4.9.
Technical ContextAI
The MongoDB BI Connector ODBC Driver (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*) bridges MongoDB's document store to SQL-based business intelligence tools via the ODBC interface. The root cause is CWE-787 (Out-of-Bounds Write): during the float-to-string conversion path, the driver calculates or assumes a maximum output length without accounting for the full range of representable IEEE 754 floating-point values. When the textual representation of an extreme float value exceeds the allocated destination buffer, the driver writes past the buffer boundary into adjacent memory, producing heap or stack corruption depending on how the buffer is allocated. This class of bug arises from reliance on fixed-size staging buffers for unbounded conversion output - a well-known C/C++ anti-pattern in ODBC driver development.
RemediationAI
Upgrade the MongoDB BI Connector ODBC Driver to version 1.4.9, which adds logic to clamp large floats during the float-to-string conversion, directly resolving this vulnerability as confirmed in the official release notes at https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9. If an immediate upgrade is not feasible, restrict MongoDB collection write access to the minimum required set of trusted principals for all collections exposed through the BI Connector - this reduces the attacker population who could plant a malicious float value, though it does not eliminate the vulnerability and may impact legitimate data ingestion workflows. No additional vendor-documented workaround is present in the available references. The release notes also address related buffer-clamping issues in catalog functions, parameter sizes, DSN path fields, and general buffer handling (CVE-2026-19001 through CVE-2026-19004), making the upgrade beneficial beyond this single CVE.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today