Memory-safety Bypass via Long LIMIT Digits in MongoDB BI Connector
CVE-2026-81533 Published on August 28, 2026
MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values
An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.
Vulnerability Analysis
CVE-2026-81533 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Stack Overflow Vulnerability?
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVE-2026-81533 has been classified to as a Stack Overflow vulnerability or weakness.
Products Associated with CVE-2026-81533
Want to know whenever a new CVE is published for MongoDB C Driver? stack.watch will email you.
Affected Versions
MongoDB BI Connector ODBC Driver:- Before 1.4.10 is affected.