CVE-2026-81532

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in MongoDB Connector for BI ODBC Driver

Publication date: 2026-08-28

Last updated on: 2026-09-11

Assigner: MongoDB, Inc.

Description

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-11

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81532

EUVD

EUVD-2026-67941

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	bi_connector_odbc_driver	to 1.4.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability involves a user submitting SQL through an application using the MongoDB Connector for BI ODBC driver. The driver contains a fixed-length buffer that stores cursor names. If a user supplies a cursor name exceeding this buffer size, adjacent memory is overwritten with user-controlled data. This can crash the hosting application and potentially allow arbitrary code execution within it.

Detection Guidance

This vulnerability involves a buffer overflow in the MongoDB Connector for BI ODBC driver due to improper handling of positioned-cursor statements. Detection requires checking for vulnerable versions of the driver and monitoring for crashes or unexpected behavior in applications using it.

Impact Analysis

An attacker could exploit this to terminate critical applications relying on the MongoDB Connector for BI ODBC driver, leading to denial of service. In severe cases, it may enable code execution, allowing unauthorized access or data manipulation. Systems using this driver are at risk if user input is not properly validated.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance failures if exploited, resulting in legal penalties or reputational damage. Proper mitigation is essential to maintain regulatory adherence.

Mitigation Strategies

Update the MongoDB Connector for BI ODBC driver to the latest patched version to prevent buffer overflow issues. Restrict user access to only necessary SQL submission privileges and monitor application logs for unusual activity.

Hi! I’m here to help you understand CVE-2026-81532. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70