CVE-2026-18888: falha de alta gravidade em MongoDB BI Connector ODBC Driver
MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.4%
The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
MongoDB · BI Connector ODBC DriverCVEs relacionadas — MongoDB BI Connector ODBC Driver
No mesmo produto, das mais perigosas para as menos.
CVE-2026-19001CRITICALMongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object namesEPSS 0.5%CVE-2026-19004HIGHMongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output ParametersEPSS 0.5%CVE-2026-81532HIGHBI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory CorruptionEPSS 0.5%CVE-2026-19002HIGHCrafted database metadata may cause memory corruption in MongoDB BI Connector ODBC DriverEPSS 0.4%CVE-2026-81533MEDIUMMongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT ValuesEPSS 0.4%CVE-2026-19003HIGHMongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settingsEPSS 0.2%