---
id: CVE-2026-19004
title: >-
  An application using the MongoDB BI Connector ODBC Driver may experience a
  memory-safety issue when processing output parameters from a stored procedure
summary: >-
  An application using the MongoDB BI Connector ODBC Driver may experience a
  memory-safety issue when processing output parameters from a stored procedure.
  Triggering this issue requires connecting to an untrusted or impersonated
  database …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-122
vendor: mongodb
product: bi_connector_odbc_driver
affected:
  - bi_connector_odbc_driver < 1.4.9
patched:
  - bi_connector_odbc_driver 1.4.9
published: '2026-08-12'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T18:59:45.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19004'
references:
  - url: >-
      https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-13T14:09:13.996015Z'
ingestedAt: '2026-09-14T11:57:36.504Z'
epss: 0.005
epssPercentile: 0.40194
---

## Overview

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

## Affected

- `bi_connector_odbc_driver < 1.4.9`

## Remediation

Upgrade past the affected range:

- `bi_connector_odbc_driver 1.4.9`