Description

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T21:17:37.170Z",
  "pubdate": "2026-08-12T21:17:37.170Z",
  "executiveSummary": "The MongoDB BI Connector ODBC Driver is susceptible to a buffer overflow vulnerability arising from improper bounds checking during data conversion processes.\nSpecifically, the vulnerability occurs when floating point column values are converted into text representations without verifying that the resulting string fits within the allocated destination buffer.\nAn unauthenticated attacker who possesses the capability to store maliciously crafted data within a MongoDB collection that is subsequently read through the BI Connector can trigger this memory corruption condition.\nSuccessful exploitation of this flaw leads to out-of-bounds write operations that corrupt adjacent memory structures, resulting in an application crash and a potential denial of service condition for the client application executing the read operation.\nThe risk is localized to systems utilizing the vulnerable ODBC driver to query untrusted or attacker-influenced collections, making strict data governance and input validation critical mitigation vectors.",
  "technicalDetails": "The root cause of the vulnerability resides within the text conversion routines of the MongoDB BI Connector ODBC Driver.\nWhen a query retrieves a floating-point column value, the driver attempts to format this numeric data into a text string to satisfy the ODBC data retrieval interface expected by the host application.\nDuring this string conversion, the driver fails to perform adequate size validation or boundary checks against the designated destination buffer provided by the reading application.\nIf a floating-point value is sufficiently large or possesses an exponent format that expands the resulting string representation beyond the bounds of the allocated buffer, the driver continues to write data past the end of the buffer.\nThis unrestricted write operation results in a classic heap or stack-based buffer overflow, depending on how the destination buffer was allocated within the calling context.\nThe attack flow proceeds as follows: first, an adversary with write access to a MongoDB database inserts a document containing a specially crafted, excessively large floating-point value into a targeted collection.\nSecond, a victim application executes an ODBC query via the MongoDB BI Connector to read data from this collection.\nThird, as the BI Connector ODBC Driver processes the result set and attempts to convert the malicious floating-point value into text, it overflows the destination memory buffer.\nThe subsequent corruption of adjacent memory corrupts internal application state, heap metadata, or call stack parameters, immediately triggering an application crash.\nWhile remote code execution may theoretically be investigated in scenarios involving precise heap manipulation, the documented direct impact is application termination and denial of service.\nThe vulnerable component is the MongoDB BI Connector ODBC Driver data conversion module.\nExploitation requires the ability to write data to a database collection read by the BI Connector and relies on the client application executing a read operation against the manipulated data."
}