CVE-2026-19004CWE-122

CVE-2026-19004

High · published August 13, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
41.9
In the wild
Unconfirmed
What it is

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00500 · 41.9th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-08-13T01:17Z
Affected products (1)
ProductVersionsFixed in
mongodb/bi_connector_odbc_driver< 1.4.91.4.9
References (1)
https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9 · [email protected]
EPSS history
Timeline
  • 12 AUG 20:33Z
    MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters
    cvelistv5