Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120952— MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write

Quick assessment

Affected
MongoDB Atlas SQL ODBC Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB Atlas SQL ODBC 驱动中存在越界写入漏洞。当从特定数据库类型检索值并将其写入固定宽度的客户端目标时，可能触发该漏洞。驱动程序会生成该值的文本形式，其长度超过 ODBC 接口所定义的固定目标长度，并在复制时未将写入范围限制在目标的实际大小内。拥有基本写入权限的数据库用户可以影响部分写入到目标之外的数据，这可能导致使用该驱动的应用程序内存被破坏，进而引发应用程序意外终止。

CVSS 7.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120952

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write
Source: CVE Program / CVE List V5
Vulnerability Description
An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB Atlas SQL ODBC Driver 0.0.1 ~ 3.0.1 -

II. Public POCs for CVE-2026-120952

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120952

请登录查看更多情报信息。

Vendor Pages for CVE-2026-120952 (1)

Other References for CVE-2026-120952 (1)

Same Patch Batch · MongoDB · 2026-11-03 · 15 CVEs total

CVE-2026-119675 8.6 HIGH mongorestore may bypass collection guards through a system.buckets prefix
CVE-2026-120678 7.5 HIGH MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to
CVE-2026-120955 7.5 HIGH MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Applicatio
CVE-2026-120956 7.1 HIGH remote abort and memory disclosure from a malformed cursor.ns
CVE-2026-119179 7.0 HIGH MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expo
CVE-2026-120684 6.5 MEDIUM MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
CVE-2026-120673 5.5 MEDIUM Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
CVE-2026-120567 5.4 MEDIUM ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions
CVE-2026-119672 4.8 MEDIUM mongofiles may disclose GridFS content to standard output through a stored filename
CVE-2026-120953 4.3 MEDIUM Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-co
CVE-2026-119674 3.7 LOW mongorestore may restore encoded collection names into an unintended collection
CVE-2026-120954 3.7 LOW Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
CVE-2026-120959 3.7 LOW MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-arra
CVE-2026-119673 2.8 LOW mongofiles may write outside the working directory through a symlink

IV. Related Vulnerabilities

Same product: Atlas SQL ODBC Driver
Same vendor: MongoDB
Same weakness: CWE-787