CVE-2026-19001

critical · 9.5

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

9.5

CVSS

0.5%

EPSS (exploit prob.)

43rd

EPSS percentile

2026-08-12

Published

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-190

Affected products

Vendor	Product	Affected versions
mongodb	bi_connector_odbc_driver	>= 1.0.0, < 1.4.9

Check a specific version with /api/v1/cve/match.

References

https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-19001