The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an…

CVE-2026-19001 is an integer-overflow-to-buffer-overflow (CWE-190) in the MongoDB BI Connector ODBC Driver, versions 1.0.0 through 1.4.8. When an application calls an ODBC catalog/metadata retrieval function (e.g., SQLTables, SQLColumns) and receives a catalog, schema, or object name exceeding the driver's fixed-size buffer, the driver miscalculates the required allocation and writes past the buffer boundary. This corrupts heap or stack memory in the *calling application's* process and, under attacker-controlled conditions, may allow arbitrary code execution in the context of that process. The fix in v1.4.9 adds length-clamping logic to catalog functions. Notably, the entire MongoDB BI Connector product is deprecated and reaches end-of-life on September 30, 2026.

The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) dramatically misrepresents the real attack surface. This is a client-side ODBC driver — not a listening network service. For AV:N to hold, an attacker must either operate a malicious mongosqld server that the victim client connects to (requiring DNS hijack, MITM, or social engineering), or must already have write access to the legitimate MongoDB database to inject oversized catalog names that flow back through metadata queries. Neither scenario is unauthenticated-remote-no-interaction in any practical sense. The 9.8 reflects a theoretical CVSS-maximizing interpretation, not how this bug would actually be reached in an enterprise.

Why this verdict

• Client-side, not server-side: The ODBC driver is a library loaded into a BI application process. It does not listen on a port. The AV:N vector requires the attacker to already control the data flowing back from a MongoDB/mongosqld server — either via a rogue server or prior database compromise. This is not unauthenticated remote exploitation in any operational sense.
• Prior access required: To deliver the oversized catalog name, the attacker needs write access to the MongoDB database (to create a maliciously named collection/schema) or network-level control to redirect or MITM the client connection. Both imply post-initial-access positioning.
• Niche, deprecated component: The MongoDB BI Connector is officially deprecated (EOL September 30, 2026). The ODBC driver is used only by organizations bridging MongoDB to SQL-based BI tools. The exposed population in a typical enterprise is single-digit machines, not fleet-scale.
• No PoC, no exploitation, bottom-quartile EPSS: Zero public exploit code, no KEV listing, EPSS 0.00377. The theoretical overflow-to-RCE chain must also defeat ASLR, DEP, and CFG on modern Windows — crash is the realistic outcome.
• Role multiplier: The MongoDB BI Connector ODBC driver occupies a *low-value analytics role* in nearly all deployments — installed on BI workstations or reporting servers. It is not an identity provider, domain controller, hypervisor, backup system, or network edge appliance. The blast radius of successful exploitation is limited to the BI application's process context running as a standard user. No high-value role in the catalog applies; the verdict floor does not engage.

Why not higher?

Despite the 9.8 vendor score, upgrading above MEDIUM requires a realistic unauthenticated remote attack path, which does not exist here. The attacker must first compromise the upstream MongoDB server or achieve network-level MITM — prerequisites that themselves represent HIGH/CRITICAL-severity events. The affected component is a deprecated niche client library, not infrastructure. No PoC and no exploitation evidence further preclude a higher rating.

Why not lower?

An integer-overflow-to-heap-overflow in a native C/C++ ODBC driver is a real memory safety bug with theoretical RCE potential. The fix confirms the issue is genuine (v1.4.9 adds clamping). Even though exploitation is difficult, the bug class is serious enough to warrant patching within a standard remediation window rather than ignoring entirely. Organizations still running the BI Connector may have it on reporting servers with access to sensitive analytical data.

1. Accelerate migration off MongoDB BI Connector to the SQL Interface — The entire product is EOL on September 30, 2026. Migrating eliminates this CVE and all future risk from the deprecated driver. Begin migration planning immediately and complete within the noisgate 365-day remediation window — which in practice means before the September 2026 EOL date.
2. Restrict ODBC DSN configurations to known-good mongosqld endpoints — Lock down ODBC Data Source Name entries via Group Policy or configuration management so that the BI Connector driver can only connect to sanctioned internal mongosqld instances. This prevents redirection to rogue servers.
3. Upgrade to ODBC Driver 1.4.9 on all machines with the driver installed — The fix is a simple driver update. Identify machines with the driver via software inventory and push the update. No mitigation SLA applies at MEDIUM — go straight to remediation within 365 days.
4. Monitor MongoDB for anomalous schema/object names — Set up a database audit rule alerting on collection or view names exceeding 1 KB. This would catch an attacker staging poisoned metadata.

Run this on each Windows host where the MongoDB BI Connector ODBC driver may be installed. Execute as a standard user in PowerShell: .\Check-CVE-2026-19001.ps1. No elevated privileges required — it reads registry and file version info only.

# Check-CVE-2026-19001.ps1
# Detects whether a vulnerable MongoDB BI Connector ODBC Driver is installed
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$found = $false
$vulnerable = $false
$fixedVersion = [version]'1.4.9.0'

# Check ODBC driver registry entries (64-bit and 32-bit)
$regPaths = @(
    'HKLM:\SOFTWARE\ODBC\ODBCINST.INI',
    'HKLM:\SOFTWARE\WOW6432Node\ODBC\ODBCINST.INI'
)

foreach ($regPath in $regPaths) {
    $drivers = Get-ChildItem -Path $regPath -ErrorAction SilentlyContinue
    foreach ($driver in $drivers) {
        if ($driver.PSChildName -match 'MongoDB') {
            $driverPath = (Get-ItemProperty -Path $driver.PSPath -Name 'Driver' -ErrorAction SilentlyContinue).Driver
            if ($driverPath -and (Test-Path $driverPath)) {
                $found = $true
                $fileVer = (Get-Item $driverPath).VersionInfo.FileVersion
                if ($fileVer) {
                    try {
                        $ver = [version]($fileVer -replace '[^0-9.]','')
                        if ($ver -lt $fixedVersion) {
                            Write-Host "VULNERABLE - MongoDB BI Connector ODBC Driver $fileVer found at $driverPath (fixed in 1.4.9)"
                            $vulnerable = $true
                        } else {
                            Write-Host "PATCHED - MongoDB BI Connector ODBC Driver $fileVer at $driverPath"
                        }
                    } catch {
                        Write-Host "UNKNOWN - Could not parse version '$fileVer' for $driverPath"
                        exit 2
                    }
                } else {
                    Write-Host "UNKNOWN - No version info for $driverPath"
                    exit 2
                }
            }
        }
    }
}

if (-not $found) {
    Write-Host "PATCHED - MongoDB BI Connector ODBC Driver not installed on this host"
    exit 0
}

if ($vulnerable) { exit 1 } else { exit 0 }

Sources

1. NVD — CVE-2026-19001
2. THREATINT — CVE-2026-19001
3. MongoDB BI Connector ODBC Driver v1.4.9 Release
4. MongoDB Atlas BI Connector Deprecation Notice
5. MongoDB BI Connector Release Notes
6. MongoDB BI Connector ODBC Driver Documentation
7. OffSeq Threat Radar — Related CVE-2026-19003