Description

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-12T21:17:37.307Z",
  "pubdate": "2026-08-12T21:17:37.307Z",
  "executiveSummary": "A buffer overflow vulnerability exists in the MongoDB BI Connector ODBC Driver affecting metadata retrieval functions. The flaw arises when an application supplies an unusually long catalog, schema, or object name to the driver, leading to a write operation outside the bounds of a fixed-size buffer.\nThis memory corruption condition can cause abnormal termination of the calling application process, resulting in a denial of service, or potentially allow for arbitrary code execution under specific exploitation conditions. The risk implications are severe for environments utilizing the ODBC driver to interface with MongoDB BI Connector instances.\nAttacker capabilities depend on the ability to control or influence the metadata query parameters passed to the driver from the calling application. Exploitation requirements typically involve an attacker supplying maliciously crafted, excessively long strings for database catalog, schema, or object names via an application leveraging the vulnerable driver.",
  "technicalDetails": "The root cause of the vulnerability is a classic stack-based or heap-based buffer overflow stemming from inadequate boundary checks and unsafe string manipulation within the MongoDB BI Connector ODBC Driver. Specifically, when metadata retrieval functions process identifiers such as catalog, schema, or object names, they copy these values into fixed-size internal buffers without validating their length against the destination buffer capacity.\nThe vulnerable component is the metadata retrieval subsystem of the MongoDB BI Connector ODBC Driver. Exploitation occurs when an application calls ODBC catalog functions (such as SQLTables, SQLColumns, or related metadata APIs) passing excessively long arguments. When the driver copies these oversized inputs into the fixed-size allocation, adjacent memory structures on the stack or heap are overwritten.\nRegarding attack flow, an adversary must interact with an application that exposes ODBC metadata querying capabilities influenced by untrusted input, or leverage an environment where malicious database object names can be introduced (e.g., via a compromised upstream database or parameter tampering). As the driver processes the oversized catalog, schema, or object names, the bounds violation triggers memory corruption.\nDepending on the exact memory layout and the nature of the overwritten data, this corruption leads either to an immediate segmentation fault and abnormal process termination (Denial of Service) or enables the overwriting of critical execution control data, such as return addresses or function pointers. If control data is successfully manipulated, an attacker could achieve arbitrary code execution within the context of the calling application's process.\nAuthentication and privilege requirements are dictated by the calling application's architecture and its access to the ODBC driver functions. The vulnerability manifests locally within the process space of the application utilizing the driver, meaning network exposure depends on whether the application itself accepts remote input that translates into ODBC metadata calls."
}