CVE-2026-19003 describes a buffer overflow vulnerability in the MongoDB BI Connector ODBC Driver setup dialog. The flaw arises from improper calculation of buffer capacity when processing over-length file path settings in data source definitions. This vulnerability is exploitable when a user opens the setup dialog and performs file or folder selection, leading to writes outside the allocated buffer. Depending on the build configuration, this can cause process crashes or, under certain conditions, arbitrary code execution in the context of the user running the dialog. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow) and has a CVSS 3.1 score of 7.8, indicating high severity.

Successful exploitation can lead to high impact outcomes including confidentiality, integrity, and availability compromises. Specifically, it may cause abnormal termination of the setup dialog process or execution of arbitrary code with the privileges of the user running the dialog, potentially allowing unauthorized actions within that user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening the MongoDB BI Connector ODBC Driver setup dialog for data sources containing over-length file path settings to prevent triggering the vulnerability.