The MongoDB BI Connector ODBC Driver contains a heap-based buffer overflow vulnerability (CWE-122) identified as CVE-2026-19004. This vulnerability arises when the driver processes output parameters from stored procedures and can be exploited by connecting to a malicious or impersonated database server that returns specially crafted metadata. Exploitation may cause the driver process to terminate unexpectedly, leak process memory, or, in some cases, allow arbitrary code execution. The affected versions include exactly 1.0.0 and all versions from 1.0.0 up to but excluding 1.4.9. The CVSS 4.0 base score is 8.8, indicating high severity. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can cause denial of service by process termination, unauthorized disclosure of process memory contents, and potentially arbitrary code execution. The attack requires connecting to a malicious or impersonated database server that returns crafted metadata, which may limit the attack vector to untrusted or compromised database environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid connecting the MongoDB BI Connector ODBC Driver to untrusted or impersonated database servers. Monitor vendor communications for updates on patches or official mitigations.