The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function.
CVSS 4.0CRITICAL 9.5·Network·No auth·No interaction·EPSS 0.00539·Published 2026-08-12·Fixed in 1.4.9CWE-190
An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure.
CVSS 4.0HIGH 8.8·Network·No auth·User interaction·EPSS 0.005·Published 2026-08-12·Fixed in 1.4.9CWE-122
A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer.
CVSS 4.0HIGH 8.7·Network·Low privileges·No interaction·EPSS 0.0049·Published 2026-08-28·Fixed in 1.4.10CWE-121
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process.
CVSS 4.0HIGH 8.8·Network·No auth·User interaction·EPSS 0.00404·Published 2026-08-12·Fixed in 1.4.9CWE-120
A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer.
CVSS 4.0HIGH 8.4·Local·No auth·User interaction·EPSS 0.00211·Published 2026-08-12·Fixed in 1.4.9CWE-121
The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer.
CVSS 4.0HIGH 7.1·Network·Low privileges·No interaction·EPSS 0.0042·Published 2026-08-12·Fixed in 1.4.9CWE-787
An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause.
CVSS 4.0MEDIUM 6.0·Network·Low privileges·No interaction·EPSS 0.00366·Published 2026-08-28·Fixed in 1.4.10CWE-121