Executive brief
The MongoDB BI Connector ODBC Driver is used by applications to connect to MongoDB databases via ODBC. A memory-safety vulnerability in how the driver processes output parameters from stored procedures could allow an attacker controlling a database server to crash the application, leak sensitive data from memory, or potentially execute arbitrary code.
Technical details
The vulnerability is a memory-safety issue (buffer handling/overflow) in the ODBC driver's output parameter processing logic. It is triggered when connecting to an untrusted or impersonated database server that returns crafted metadata with unclamped buffer sizes. The attack requires network access to a database the application connects to, but does not require authentication to the application itself. Successful exploitation can result in process termination (denial of service), disclosure of process memory contents, or under certain conditions arbitrary code execution. The fix (clamping buffer sizes) was included in version 1.4.9 released on 06 Aug.
Affected products
- MongoDB BI Connector ODBC Driver before 1.4.9
Timeline
- 2026-08-12: disclosed