CVE-2026-19001: MongoDB BI Connector Buffer Overflow Flaw

CVE-2026-19001 Overview

CVE-2026-19001 is a buffer overflow vulnerability in the MongoDB BI Connector Open Database Connectivity (ODBC) Driver. The driver writes outside the bounds of a fixed-size buffer when an application passes an unusually long catalog, schema, or object name to a metadata retrieval function. The out-of-bounds write corrupts memory in the calling application's process. Corruption can cause abnormal termination and, under specific conditions, arbitrary code execution within the host process. The flaw is classified as [CWE-190] and affects driver builds prior to v1.4.9.

Critical Impact
Attackers who can control identifier arguments passed to ODBC metadata calls may corrupt process memory and potentially execute arbitrary code in the context of the calling application.

Affected Products

MongoDB BI Connector ODBC Driver versions prior to v1.4.9
Applications embedding the vulnerable ODBC driver for MongoDB metadata queries
BI and reporting tools linking against the MongoDB ODBC driver on Windows, macOS, and Linux

Discovery Timeline

2026-08-12 - CVE-2026-19001 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19001

Vulnerability Analysis

The MongoDB BI Connector exposes an ODBC interface that allows Business Intelligence tools to query MongoDB using Structured Query Language (SQL). ODBC applications call metadata functions such as SQLTables, SQLColumns, and SQLStatistics to enumerate catalogs, schemas, tables, and columns. These functions accept identifier strings supplied by the calling application.

The driver allocates a fixed-size buffer to hold these identifier arguments internally. When the caller supplies a catalog, schema, or object name longer than the buffer capacity, the driver writes past the buffer boundary. This corrupts adjacent memory in the calling process. The consequences range from an immediate crash to controlled overwrites of function pointers or return addresses, enabling arbitrary code execution.

The issue is tracked under [CWE-190: Integer Overflow or Wraparound], indicating that a size or length calculation likely wraps or is truncated before the copy operation. This causes the driver to trust an attacker-controllable length value when performing a memory write.

Root Cause

The root cause is missing or incorrect bounds validation on identifier length values before copying user-supplied data into a fixed-size internal buffer. The metadata retrieval code path does not clamp the input length to the destination buffer size, and an integer calculation involving that length permits an out-of-bounds write. See the GitHub Release v1.4.9 notes for the fix commit.

Attack Vector

Exploitation requires an application to pass attacker-influenced catalog, schema, or object name strings into the driver's metadata functions. Where a BI application accepts identifier names from a user, remote form, saved report, or upstream data source, an attacker can craft inputs long enough to trigger the overflow. Successful memory corruption executes in the process context of the calling application, which may hold database credentials or additional privileges.

The vulnerability is described in prose only. No verified proof-of-concept is public at the time of publication. Refer to the MongoDB BI Connector ODBC Driver v1.4.9 release for the patched code.

Detection Methods for CVE-2026-19001

Indicators of Compromise

Unexpected crashes or access violations in processes that load the MongoDB BI Connector ODBC driver library
Windows Error Reporting (WER) or coredump entries referencing the ODBC driver module
Anomalous child processes spawned from BI tools such as Tableau, Power BI Gateway, or custom ODBC applications shortly after metadata queries
ODBC trace logs containing catalog, schema, or object identifiers of unusual length

Detection Strategies

Inventory endpoints and servers for installed MongoDB BI Connector ODBC driver versions and flag any build prior to v1.4.9
Enable ODBC driver tracing on high-value BI hosts and alert on identifier arguments exceeding expected length thresholds
Correlate process crashes in BI applications with recent ODBC metadata function calls using endpoint detection telemetry

Monitoring Recommendations

Monitor for new or unexpected loads of the MongoDB ODBC driver module in processes that do not normally consume it
Alert on BI or reporting application processes launching command interpreters, powershell.exe, or cmd.exe
Track outbound connections from BI hosts to unfamiliar destinations following ODBC-related crash events

How to Mitigate CVE-2026-19001

Immediate Actions Required

Upgrade the MongoDB BI Connector ODBC Driver to v1.4.9 or later on every system where it is installed
Restart all applications and services that have loaded the driver so they pick up the patched library
Audit BI dashboards, reports, and connectors for identifier inputs sourced from untrusted users or external data feeds

Patch Information

MongoDB has released a fixed build in MongoDB BI Connector ODBC Driver v1.4.9. The release notes reference the boundary-handling fix in the metadata retrieval functions. Deploy the vendor-signed installer package for the target operating system and verify the installed driver version through the ODBC Administrator or platform-specific driver registry.

Workarounds

Restrict the driver's use to trusted client applications and controlled input paths until patching is complete
Enforce input validation in calling applications so that catalog, schema, and object name arguments passed to ODBC metadata functions are bounded to reasonable lengths
Remove the MongoDB BI Connector ODBC driver from hosts that no longer require it

bash

# Verify the installed driver version on Linux
odbcinst -q -d -n "MongoDB ODBC"
cat /etc/odbcinst.ini | grep -A 5 "MongoDB"

# Confirm the patched version is 1.4.9 or later before allowing BI workloads to resume