Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81533— MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values

Quick assessment

Affected
MongoDB BI Connector ODBC Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

使用 MongoDB BI Connector ODBC 驱动程序的应用程序可能会遇到内存安全问题，当提交的 SQL 语句中包含一个跟在 LIMIT 子句后面的异常长的数字串时，就会触发该问题。此问题仅发生在启用了驱动程序可选预取（prefetch）设置的连接上，根源在于驱动程序在将数字序列复制到固定大小的内部缓冲区时，未对其长度进行校验。能够影响 LIMIT 子句中数值部分的用户，可能导致宿主应用程序进程意外终止，或造成该进程中相邻内存的损坏。

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81533

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values
Source: CVE Program / CVE List V5
Vulnerability Description
An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB BI Connector ODBC Driver 0 ~ 1.4.10 -

II. Public POCs for CVE-2026-81533

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81533

请登录查看更多情报信息。

Vendor Pages for CVE-2026-81533 (1)

Same Patch Batch · MongoDB · 2026-08-28 · 11 CVEs total

CVE-2026-81532 8.8 HIGH BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corrupt
CVE-2026-77586 8.0 HIGH MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output
CVE-2026-81490 7.7 HIGH MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of
CVE-2026-81517 7.5 HIGH MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of S
CVE-2026-81518 7.5 HIGH BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections
CVE-2026-81520 7.5 HIGH MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaus
CVE-2026-76798 6.3 MEDIUM MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports
CVE-2026-76797 6.3 MEDIUM MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generate
CVE-2026-77184 5.2 MEDIUM MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE O
CVE-2026-76794 4.6 MEDIUM MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Da

IV. Related Vulnerabilities

Same product: BI Connector ODBC Driver
Same vendor: MongoDB
Same weakness: CWE-121

V. Comments for CVE-2026-81533

No comments yet

Leave a comment