CVE-2026-120952 is a vulnerability in MongoDB C Driver
Published on November 3, 2026
MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write
An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.
Vulnerability Analysis
CVE-2026-120952 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-120952 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2026-120952
Want to know whenever a new CVE is published for MongoDB C Driver? stack.watch will email you.
Affected Versions
MongoDB Atlas SQL ODBC Driver:- Version 0.0.1 and below 3.0.1 is affected.