CVE-2026-19004

CVE-2026-19004 affects the MongoDB BI Connector ODBC Driver. The issue is a memory-safety flaw that occurs when processing output parameters from a stored procedure, triggered when connecting to an untrusted or impersonated database server returning crafted metadata. Consequences described includ...

CVE-2026-19001

The CVE-2026-19001 issue affects the MongoDB BI Connector ODBC Driver. Affected component: ODBC driver; vulnerability: writes outside a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function, causing memory corruption in t...

CVE-2026-18888

CVE-2026-18888 : The MongoDB BI Connector ODBC Driver converts floating point column values into text without verifying that the resulting string fits the destination buffer, which can allow writing past the end of the buffer and corrupt adjacent memory when reading large values. Reported impact ...

CVE-2026-19002

The CVE-2026-19002 entry affects the MongoDB BI Connector ODBC Driver. A missing bounds check during parsing of stored procedure parameter metadata can cause an out-of-bounds write in the client process, leading to memory corruption and potential abnormal termination or, under certain conditions,...

CVE-2026-19003

MongoDB BI Connector ODBC Driver vulnerability (CVE-2026-19003) affects the driver’s setup dialog for data sources with overly long path settings. The root cause is an incorrect buffer capacity calculation in the dialog’s file/folder selection handling, which can cause the driver to write outside...

CVE-2026-81533

CVE-2026-81533 is a memory-safety vulnerability in the MongoDB BI Connector ODBC Driver . The root cause is the driver copying an unusually long digit sequence following a LIMIT clause into a fixed-size internal buffer without a length check. The issue is only reachable on connections where the d...

CVE-2026-81532

CVE-2026-81532 affects the MongoDB Connector for BI ODBC driver . The root cause is improper bounds checking on a positioned-cursor statement's cursor name : because the name length is not bounded before the driver builds its diagnostic message, an overly long name overwrites memory adjacent to a...