CVE-2026-19002: high-severity vulnerability in MongoDB BI Connector ODBC Driver
Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.4%
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
Affected products
MongoDB · BI Connector ODBC DriverRelated CVEs — MongoDB BI Connector ODBC Driver
In the same product, most dangerous first.
CVE-2026-19001CRITICALMongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object namesEPSS 0.5%CVE-2026-19004HIGHMongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output ParametersEPSS 0.5%CVE-2026-81532HIGHBI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory CorruptionEPSS 0.5%CVE-2026-18888HIGHMongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character dataEPSS 0.4%CVE-2026-81533MEDIUMMongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT ValuesEPSS 0.4%CVE-2026-19003HIGHMongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settingsEPSS 0.2%