CVE-2026-19001CWE-190

CVE-2026-19001

Critical · published August 13, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00539 · 44.5th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-08-13T01:17Z
Affected products (1)
ProductVersionsFixed in
mongodb/bi_connector_odbc_driver≥ 1.0.0, < 1.4.91.4.9
References (1)
https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9 · [email protected]
EPSS history
Timeline
  • 12 AUG 20:27Z
    MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names
    cvelistv5