CVE-2026-81533— MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values
Quick assessment
Affected
MongoDB BI Connector ODBC Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB BI Connector ODBC Driver是美国MongoDB公司的一款数据库连接驱动软件。 MongoDB BI Connector ODBC Driver 1.4.10之前版本存在缓冲区错误漏洞，该漏洞源于在启用可选预取设置时，驱动程序将SQL语句中LIMIT子句后的长数字序列复制到固定大小内部缓冲区而未检查长度，可能导致宿主应用程序进程意外终止或破坏相邻内存。
Possible ATT&CK Techniques 3 AI
T1059.005 · Visual Basic T1190 · Exploit Public-Facing Application T1578 · Modify Cloud Compute InfrastructureAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | BI Connector ODBC Driver | < 1.4.10 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81533
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values
Source: CVE Program / CVE List V5
Vulnerability Description
An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB BI Connector ODBC Driver 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB BI Connector ODBC Driver是美国MongoDB公司的一款数据库连接驱动软件。 MongoDB BI Connector ODBC Driver 1.4.10之前版本存在缓冲区错误漏洞，该漏洞源于在启用可选预取设置时，驱动程序将SQL语句中LIMIT子句后的长数字序列复制到固定大小内部缓冲区而未检查长度，可能导致宿主应用程序进程意外终止或破坏相邻内存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | BI Connector ODBC Driver | 0 ~ 1.4.10 | - |
|
II. Public POCs for CVE-2026-81533
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81533
请登录查看更多情报信息。
Vendor Pages for CVE-2026-81533 (1)
Same Patch Batch · MongoDB · 2026-08-28 · 11 CVEs total
| CVE-2026-81532 | 8.8 HIGH | BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corrupt |
| CVE-2026-77586 | 8.0 HIGH | MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output |
| CVE-2026-81490 | 7.7 HIGH | MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of |
| CVE-2026-81517 | 7.5 HIGH | MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of S |
| CVE-2026-81518 | 7.5 HIGH | BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections |
| CVE-2026-81520 | 7.5 HIGH | MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaus |
| CVE-2026-76798 | 6.3 MEDIUM | MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports |
| CVE-2026-76797 | 6.3 MEDIUM | MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generate |
| CVE-2026-77184 | 5.2 MEDIUM | MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE O |
| CVE-2026-76794 | 4.6 MEDIUM | MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Da |
IV. Related Vulnerabilities
Same product: BI Connector ODBC Driver
-
CVE-2026-81532
BI Connector ODBC Driver Improper Bounds Checking on Cursor -
CVE-2026-19003
MongoDB BI Connector ODBC driver may write outside an alloca -
CVE-2026-19004
MongoDB BI Connector ODBC Driver Memory-Safety Issue When Ha -
CVE-2026-18888
MongoDB BI Connector ODBC driver may write outside an alloca -
CVE-2026-19001
MongoDB BI Connector ODBC driver may write outside an alloca
Same vendor: MongoDB
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-104004
Collection validators using collation-accepting expressions -
CVE-2026-103965
Fixed values in MongoDB Server $bucket stage may be misread -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_
Same weakness: CWE-121
-
CVE-2026-79840
HPE NonStop XABroker - Memory corruption vulnerability -
CVE-2026-79839
HPE NonStop ODBC/MX Server - Memory corruption vulnerability -
CVE-2026-79838
HPE NonStop ODBC/MX Services - Memory corruption vulnerabili -
CVE-2026-79832
HPE NonStop SQL/MX Executor - Buffer overflow vulnerability -
CVE-2026-79830
HPE NonStop Kernel Level Thread Model Lib - Stack buffer ove
V. Comments for CVE-2026-81533
No comments yet