CVE-2026-81532— BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption
Quick assessment
Affected
MongoDB BI Connector ODBC Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB BI Connector ODBC Driver是美国MongoDB公司的一款数据库连接驱动软件。 MongoDB BI Connector ODBC Driver 1.4.10之前版本存在缓冲区错误漏洞，该漏洞源于游标名称长度未限制，可能导致缓冲区溢出，终止宿主应用程序进程并可能运行非预期代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | BI Connector ODBC Driver | < 1.4.10 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81532
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption
Source: CVE Program / CVE List V5
Vulnerability Description
A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB BI Connector ODBC Driver 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB BI Connector ODBC Driver是美国MongoDB公司的一款数据库连接驱动软件。 MongoDB BI Connector ODBC Driver 1.4.10之前版本存在缓冲区错误漏洞，该漏洞源于游标名称长度未限制，可能导致缓冲区溢出，终止宿主应用程序进程并可能运行非预期代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | BI Connector ODBC Driver | 0 ~ 1.4.10 | - |
|
II. Public POCs for CVE-2026-81532
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81532
请登录查看更多情报信息。
Vendor Pages for CVE-2026-81532 (1)
Same Patch Batch · MongoDB · 2026-08-28 · 11 CVEs total
| CVE-2026-77586 | 8.0 HIGH | MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output |
| CVE-2026-81490 | 7.7 HIGH | MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of |
| CVE-2026-81517 | 7.5 HIGH | MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of S |
| CVE-2026-81518 | 7.5 HIGH | BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections |
| CVE-2026-81520 | 7.5 HIGH | MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaus |
| CVE-2026-81533 | 7.1 HIGH | MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values |
| CVE-2026-76798 | 6.3 MEDIUM | MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports |
| CVE-2026-76797 | 6.3 MEDIUM | MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generate |
| CVE-2026-77184 | 5.2 MEDIUM | MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE O |
| CVE-2026-76794 | 4.6 MEDIUM | MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Da |
IV. Related Vulnerabilities
Same product: BI Connector ODBC Driver
-
CVE-2026-81533
MongoDB BI Connector ODBC Driver Memory-Safety Issue When Pa -
CVE-2026-19003
MongoDB BI Connector ODBC driver may write outside an alloca -
CVE-2026-19004
MongoDB BI Connector ODBC Driver Memory-Safety Issue When Ha -
CVE-2026-18888
MongoDB BI Connector ODBC driver may write outside an alloca -
CVE-2026-19001
MongoDB BI Connector ODBC driver may write outside an alloca
Same vendor: MongoDB
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-104004
Collection validators using collation-accepting expressions -
CVE-2026-103965
Fixed values in MongoDB Server $bucket stage may be misread -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_
Same weakness: CWE-121
-
CVE-2026-79840
HPE NonStop XABroker - Memory corruption vulnerability -
CVE-2026-79839
HPE NonStop ODBC/MX Server - Memory corruption vulnerability -
CVE-2026-79838
HPE NonStop ODBC/MX Services - Memory corruption vulnerabili -
CVE-2026-79832
HPE NonStop SQL/MX Executor - Buffer overflow vulnerability -
CVE-2026-79830
HPE NonStop Kernel Level Thread Model Lib - Stack buffer ove
V. Comments for CVE-2026-81532
No comments yet