MongoDB BI Connector ODBC Driver Buffer Overflow in Float to Text Conversion
CVE-2026-18888 Published on August 12, 2026
MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data
The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.
Vulnerability Analysis
CVE-2026-18888 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-18888 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2026-18888
Want to know whenever a new CVE is published for MongoDB C Driver? stack.watch will email you.
Affected Versions
MongoDB BI Connector ODBC Driver:- Version 1.0.0 and below 1.4.9 is affected.