CVE-2026-19003 Overview
CVE-2026-19003 is a stack-based buffer overflow [CWE-121] in the MongoDB BI Connector ODBC Driver setup dialog. A data source definition containing an over-length file path setting can cause the dialog to write beyond an allocated buffer. The flaw stems from an incorrect buffer capacity calculation in the file and folder selection handling.
Triggering the issue requires a user to open the setup dialog for a malicious data source and initiate a file or folder selection. Depending on build configuration, the outcome ranges from abnormal process termination to execution of unintended code in the context of the user running the dialog.
Critical Impact
Local attackers can achieve arbitrary code execution in the user's context by inducing them to open a crafted DSN in the setup dialog.
Affected Products
- MongoDB BI Connector ODBC Driver versions prior to v1.4.9
- Windows ODBC Data Source setup dialog component
- Systems with data source definitions supplied by untrusted parties
Discovery Timeline
- 2026-08-12 - CVE-2026-19003 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19003
Vulnerability Analysis
The vulnerability lives in the ODBC driver's setup dialog, specifically in the routines that handle file and folder selection for data source configuration. When the dialog processes a data source definition (DSN) containing an over-length file path setting, it miscalculates the required buffer capacity. The subsequent write operation exceeds the bounds of the allocated stack buffer.
Exploitation requires user interaction. A victim must open the setup dialog for the crafted DSN and then initiate a file or folder selection action. This local attack path is consistent with attacker-supplied configuration files that a target opens in the ODBC Data Source Administrator.
Root Cause
The root cause is an incorrect buffer capacity calculation in the dialog's file and folder selection logic. The code determines destination buffer size using a value that does not reflect the true capacity of the target allocation. When the source file path exceeds that miscomputed limit, the copy operation overwrites adjacent stack memory, matching the pattern described by CWE-121: Stack-based Buffer Overflow.
Attack Vector
The attack is local and requires user interaction. An attacker crafts a data source definition with an over-length file path setting and delivers it to the target through a shared configuration file, malicious installer, or supply-chain vector. When the user opens the DSN in the setup dialog and triggers a file or folder browser, the overflow occurs. Depending on how the driver was built, exploitation may enable arbitrary code execution under the user's account. Refer to the MongoDB BI Connector ODBC Driver v1.4.9 release notes for vendor detail.
Detection Methods for CVE-2026-19003
Indicators of Compromise
- Unexpected crashes of the ODBC Data Source Administrator (odbcad32.exe) or the BI Connector setup DLL when opening a DSN
- DSN entries in the Windows registry under HKLM\SOFTWARE\ODBC\ODBC.INI or HKCU\SOFTWARE\ODBC\ODBC.INI containing abnormally long file path values
- Windows Error Reporting (WER) or crash dumps referencing the MongoDB BI Connector ODBC setup module with stack corruption signatures
Detection Strategies
- Inventory installed ODBC drivers and flag hosts running MongoDB BI Connector ODBC Driver versions below v1.4.9
- Monitor process creation events for odbcad32.exe loading the vulnerable BI Connector setup DLL, followed by process termination or child process spawn
- Alert on modification of ODBC DSN registry keys by non-administrative or untrusted processes
Monitoring Recommendations
- Ingest Windows Application and WER event logs into a central data lake to correlate ODBC dialog crashes across the fleet
- Track EDR telemetry for unusual child processes spawned by odbcad32.exe after DSN interaction
- Enable command-line and DLL load auditing to attribute setup dialog activity to specific user sessions
How to Mitigate CVE-2026-19003
Immediate Actions Required
- Upgrade the MongoDB BI Connector ODBC Driver to v1.4.9 or later on all Windows hosts where it is installed
- Audit existing DSN entries and remove or normalize any with unusually long file path values
- Restrict configuration of shared DSNs to trusted administrators and block DSN files from untrusted sources
Patch Information
MongoDB addressed the buffer overflow in version v1.4.9 of the BI Connector ODBC Driver. The fix corrects the buffer capacity calculation in the file and folder selection handling within the setup dialog. Download the patched release and installation guidance from the MongoDB BI Connector ODBC Driver v1.4.9 release page.
Workarounds
- Instruct users to avoid opening the ODBC setup dialog for DSNs received from untrusted sources until patching completes
- Remove the BI Connector ODBC Driver from systems that do not require MongoDB BI connectivity
- Apply least-privilege policies so the interactive user account cannot execute high-impact operations if code execution occurs
# Query installed MongoDB BI Connector ODBC Driver version on Windows
reg query "HKLM\SOFTWARE\ODBC\ODBCINST.INI\MongoDB ODBC ANSI Driver" /v DriverVer
reg query "HKLM\SOFTWARE\ODBC\ODBCINST.INI\MongoDB ODBC Unicode Driver" /v DriverVer
# Enumerate DSN entries for review
reg query "HKLM\SOFTWARE\ODBC\ODBC.INI" /s
reg query "HKCU\SOFTWARE\ODBC\ODBC.INI" /s
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
