What’s Vulnerable › Vulnerabilities
CVE-2026-19004: MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-12 · updated 2026-10-23
- Weakness: CWE-122
Description
An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.
Affected products
- MongoDB BI Connector ODBC Driver: before 1.4.9 — fixed in 1.4.9
How to fix
Upgrade to a fixed version: MongoDB BI Connector ODBC Driver 1.4.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19004 or the next vulnerability affects your stack