Live › vulnerability › CVE-2026-120952
The MongoDB Atlas SQL ODBC Driver writes an over-long text value into a fixed-size client buffer without a size limit when certain database types are retrieved. A database user with basic write privileges can influence part of the overflowing data, which may corrupt memory in the application and make it terminate unexpectedly.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Applications that connect to MongoDB Atlas through the MongoDB Atlas SQL ODBC Driver and retrieve values of the affected database types into fixed-width client buffers are exposed. The risk requires a database user with basic write privileges, so teams that do not use this driver or whose database users are tightly restricted can likely skip it. unknown for the exact affected versions.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.
This page as .md · .json · in your agent: get_signal("CVE-2026-120952")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.