Vulnerability record · CVE-2026-19004 · published 12 August 2026

CVE-2026-19004: Mongodb bi connector odbc driver heap-based buffer overflow vulnerability

Mongodb · Bi Connector Odbc Driver

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

8.8 CVSS 4.0 High EPSS 0.50% · top 59.6% CWE-122 · Heap-based buffer overflow

8.8CVSS 4.0 base score

0.50%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

1References

11 Sep 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Bi Connector Odbc Driver Mongodb

References

Link	Tags
https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9	Release NotesVendor Advisory

Track CVE-2026-19004 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.5CVE-2026-19001Mongodb bi connector odbc driver integer overflow vulnerabilityThe MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, sche…EPSS 0.54%12 Aug 2026 8.8CVE-2026-19002Mongodb bi connector odbc driver classic buffer overflow vulnerabilityA missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write …EPSS 0.40%12 Aug 2026 8.7CVE-2026-81532Mongodb bi connector odbc driver stack-based buffer overflow vulnerabilityA user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor…EPSS 0.49%28 Aug 2026 8.4CVE-2026-19003Mongodb bi connector odbc driver stack-based buffer overflow vulnerabilityA data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the…EPSS 0.21%12 Aug 2026 7.1CVE-2026-18888Mongodb bi connector odbc driver out-of-bounds write vulnerabilityThe MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buf…EPSS 0.32%12 Aug 2026 6.0CVE-2026-81533Mongodb bi connector odbc driver stack-based buffer overflow vulnerabilityAn application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually lo…EPSS 0.37%28 Aug 2026 9.3CVE-2026-94127F5 big-ip access policy manager heap-based buffer overflow vulnerabilityWhen a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution…KEVEPSS 2.2%22 Sep 2026 9.8CVE-2025-25249Fortinet FortiOS and FortiSwitchManager heap buffer overflow via crafted packetsA heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0 through 7.2.6 lets an unauthenticated…KEVEPSS 3.9%analysed13 Jan 2026

Source: NIST National Vulnerability Database (record CVE-2026-19004), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.