Threat Intelligence Database

CVE-2026-19003 is a stack-based buffer overflow vulnerability in the MongoDB BI Connector ODBC Driver setup dialog. It occurs when a data source definition contains an over-length file path, causing the dialog to write outside the bounds of an allocated buffer during file or folder selection. This can lead to abnormal termination or potentially execution of unintended code under certain conditions. The vulnerability affects versions 1.0.0 and all versions from 1.0.0 up to but not including 1.4.9. The CVSS 4.0 score is 8.4, indicating high severity.

CVE-2026-19004 is a heap-based buffer overflow vulnerability in the MongoDB BI Connector ODBC Driver. It occurs when processing output parameters from a stored procedure, triggered by connecting to an untrusted or impersonated database server that returns crafted metadata. This vulnerability can lead to process termination, disclosure of process memory, or potentially arbitrary code execution under certain conditions. The issue affects versions 1.0.0 and all versions from 1.0.0 up to but not including 1.4.9. The vulnerability has a high severity score of 8.8 (CVSS 4.0). No official patch or remediation guidance has been provided yet.

CVE-2026-19002 is a high-severity buffer overflow vulnerability in the MongoDB BI Connector ODBC Driver. It arises from a missing bounds check when parsing stored procedure parameter metadata, allowing an out-of-bounds write in the client application process. Exploitation requires control over or the ability to impersonate the server the driver connects to, to supply malformed metadata. This memory corruption can cause application crashes or potentially execute unintended code.

CVE-2026-19001 is a critical integer overflow vulnerability in the MongoDB BI Connector ODBC Driver. It occurs when an application provides an unusually long catalog, schema, or object name to a metadata retrieval function, causing the driver to write outside the bounds of a fixed-size buffer. This memory corruption can lead to abnormal termination of the calling application and potentially allow arbitrary code execution under certain conditions.

CVE-2026-18888 is a high severity vulnerability in the MongoDB BI Connector ODBC Driver where the driver improperly converts floating point column values to text without verifying buffer size. This can lead to an out-of-bounds write, causing memory corruption and potentially crashing the application reading the data. The issue affects versions 1.0.0 and all versions from 1.0.0 up to but not including 1.4.9.