CVE-2026-18888

Katalog CVE

CVSS 6.5 · Medium EPSS 0,32%

Kerentanan Out-of-bounds Write pada mongodb bi connector odbc driver. Skor CVSS 3.1 6.5 (Medium) menurut mongodb.com.

Deskripsi (NVD)

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

Rincian

Terbit di NVD

12 Agustus 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber mongodb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9 advisory vendor · release notes