CVE-2026-19003

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in MongoDB BI Connector ODBC Driver

Publication date: 2026-08-12

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-28

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-19003

EUVD

EUVD-2026-57630

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	bi_connector_odbc_driver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability involves a buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog. When a data source has an overly long file path, the dialog incorrectly calculates buffer capacity during file or folder selection. This can lead to memory corruption, causing crashes or potentially allowing unintended code execution in the user's context.

Detection Guidance

This vulnerability is specific to the MongoDB BI Connector ODBC Driver setup dialog and requires user interaction to trigger. Detection would involve checking for the presence of vulnerable versions of the driver and monitoring for abnormal process terminations or unexpected code execution during setup dialog interactions.

Impact Analysis

If exploited, this flaw could allow attackers to execute arbitrary code on your system or crash the application. It requires user interaction, such as opening the setup dialog and selecting a file or folder, making social engineering a potential attack vector.

Compliance Impact

The vulnerability may lead to abnormal process termination or unintended code execution in the context of the user running the dialog. This could potentially result in unauthorized data access, modification, or exfiltration, which may violate compliance requirements under GDPR or HIPAA depending on the data involved.

Mitigation Strategies

Update the MongoDB BI Connector ODBC Driver to the latest version that fixes the buffer overflow issue. Avoid using data source definitions with over-length file paths until the update is applied.

Hi! I’m here to help you understand CVE-2026-19003. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70