MongoDB ODBC Connector DB Overwrite CVE-2026-81532
CVE-2026-81532 Published on August 28, 2026
BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption
A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.
Vulnerability Analysis
CVE-2026-81532 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Stack Overflow Vulnerability?
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVE-2026-81532 has been classified to as a Stack Overflow vulnerability or weakness.
Products Associated with CVE-2026-81532
Want to know whenever a new CVE is published for MongoDB C Driver? stack.watch will email you.
Affected Versions
MongoDB BI Connector ODBC Driver:- Before 1.4.10 is affected.