CVE-2026-19002
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this requires control over the server the driver connects to, or the ability to respond in its place, to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.
Risk Assessment
The risk includes client application crashes or potential code execution in the user's context, which could lead to system compromise.
Recommendation
Update the MongoDB BI Connector ODBC Driver to a patched version and ensure connections to databases are made only to trusted servers.
Original NVD description (English source)
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.