CVE-2026-19002: Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19002?
CVE-2026-19002 has a severity score of 8.1, which is classified as high.
How do I fix CVE-2026-19002?
To fix CVE-2026-19002, update the MongoDB BI Connector ODBC driver to the latest version.
What type of vulnerability is identified in CVE-2026-19002?
CVE-2026-19002 is a memory corruption vulnerability related to a missing bounds check in the MongoDB BI Connector ODBC Driver.
What can be affected by CVE-2026-19002?
CVE-2026-19002 can affect the client application process that utilizes the MongoDB BI Connector ODBC Driver.
What conditions are required to exploit CVE-2026-19002?
Exploitation of CVE-2026-19002 requires control over the server that the MongoDB BI Connector ODBC Driver connects to.