Description

A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-12T22:17:15.153Z",
  "pubdate": "2026-08-12T22:17:15.153Z",
  "executiveSummary": "A buffer overflow vulnerability exists within the MongoDB BI Connector ODBC Driver setup dialog, specifically triggered during file and folder selection handling. The root cause stems from an incorrect buffer capacity calculation when processing an over-length file path setting supplied via a data source definition. Successful exploitation of this flaw can lead to consequences ranging from abnormal process termination to the execution of unintended code.\nThe impact of this vulnerability encompasses potential arbitrary code execution within the security context of the user interacting with the setup dialog. Attackers must achieve a prerequisite condition where a user opens the vulnerable setup dialog for a maliciously configured data source and actively initiates a file or folder selection prompt.\nAffected systems comprise environments utilizing the MongoDB BI Connector ODBC Driver. Risk implications include local application compromise, denial of service via process crashes, and potential privilege escalation depending on the privileges of the user running the administrative dialog interface.\nAttacker capabilities are constrained by the requirement for user interaction, as the execution vector relies entirely on the victim loading a specially crafted data source definition and manually interacting with the graphical selection interface.",
  "technicalDetails": "The vulnerability resides in the file and folder selection handling routines of the MongoDB BI Connector ODBC Driver setup dialog. The vulnerable component fails to properly compute the necessary buffer capacity when dealing with excessively long file paths defined within a data source configuration.\nWhen a user opens the setup dialog associated with a crafted data source definition containing an over-length file path and subsequently initiates a file or folder selection action, the application attempts to copy path data into a statically allocated or improperly sized memory buffer. Due to the flawed arithmetic in the buffer capacity calculation, the input data exceeds the bounds of the allocated buffer, resulting in a classic stack- or heap-based buffer overflow condition.\nThe attack flow proceeds as follows: First, an attacker creates or modifies a data source definition to include a maliciously constructed, over-length file path setting. Second, the target user opens the setup dialog for this data source within the MongoDB BI Connector ODBC Driver. Third, the user interacts with the dialog to initiate a file or folder selection function. Fourth, the driver's internal handling mechanism processes the oversized path string, executing an out-of-bounds write operation.\nDepending on compiler build configurations, memory layout protections, and platform-specific mitigations, the payload behavior manifests either as an unhandled exception causing abnormal process termination (Denial of Service) or the corruption of adjacent memory structures. Under specific environmental conditions, this memory corruption enables the execution of unintended native code injected via the over-length path string.\nAuthentication and privilege requirements are dictated by the local user context; the attacker must rely on local file modification capabilities to alter the data source definition or trick a user into importing it. Network exposure is non-existent for this specific attack vector, as the vulnerability is strictly triggered locally through the graphical user interface setup dialog handling of data source settings."
}