CVE-2026-19002

Katalog CVE

CVSS 8.1 · High EPSS 0,40%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada mongodb bi connector odbc driver. Skor CVSS 3.1 8.1 (High) menurut mongodb.com.

Deskripsi (NVD)

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

Rincian

Terbit di NVD

12 Agustus 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber mongodb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9 advisory vendor · release notes