{"id":"CVE-2026-120952","kind":"vulnerability","aliases":["CVE-2026-120952"],"related":[],"title":"MongoDB Atlas SQL ODBC Driver: out-of-bounds write can corrupt client memory and crash apps","description":"An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.","summary":"The MongoDB Atlas SQL ODBC Driver writes an over-long text value into a fixed-size client buffer without a size limit when certain database types are retrieved. A database user with basic write privileges can influence part of the overflowing data, which may corrupt memory in the application and make it terminate unexpectedly.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["atlas-sql","memory-corruption","mongodb","odbc","package"],"not_affected_if":["driver-not-used","no-untrusted-db-writers"],"how_to_check":"- Check whether an application uses the MongoDB Atlas SQL ODBC Driver (installed ODBC drivers list, or the driver name in DSN/connection strings), and note the driver version.\n- Affected and fixed versions are unknown: MongoDB has not published them in the sources read. Watch https://www.mongodb.com/resources/products/alerts and the SQL Interface changelog; the latest ODBC release is 3.0.0.","fix":null,"status":"open","published_at":"2026-11-03T21:17:04+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","triaged_at":"2026-11-03T21:20:39+00:00","updated_at":"2026-11-03T21:24:00+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T21:20:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Atlas SQL ODBC Driver: out-of-bounds write can corrupt client memory and crash apps","impact":"medium","summary":"The MongoDB Atlas SQL ODBC Driver writes an over-long text value into a fixed-size client buffer without a size limit when certain database types are retrieved. A database user with basic write privileges can influence part of the overflowing data, which may corrupt memory in the application and make it terminate unexpectedly.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongodb","odbc","atlas-sql"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Application memory corrupted, application crashes; possible influence on written data","analyst_note":"Find the affected and fixed driver versions and the vendor advisory for CVE-2026-120952 at the NVD page cited in the sources.","how_to_check":"- Check whether an application uses the MongoDB Atlas SQL ODBC Driver, for example by listing installed ODBC drivers or looking for the driver name in connection strings.\n- Check the installed driver version against the fixed release stated by the vendor: unknown if the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["driver-not-used","no-untrusted-db-writers"],"who_is_affected":"Applications that connect to MongoDB Atlas through the MongoDB Atlas SQL ODBC Driver and retrieve values of the affected database types into fixed-width client buffers are exposed. The risk requires a database user with basic write privileges, so teams that do not use this driver or whose database users are tightly restricted can likely skip it. unknown for the exact affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4196,"output_tokens":642,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed driver versions and the vendor advisory for CVE-2026-120952 at the NVD page cited in the sources.","search":"'-120952':20A,23A '-2026':19A,22A 'app':17A 'applic':83B,180C,187C 'atlas':2A,25B,35B,98C 'atlas-sql':24B 'basic':67B,161C 'bound':9A,93C 'buffer':52B 'caus':185C 'certain':58B 'client':13A,51B,121C 'client-sid':120C 'copi':145C,150C 'corrupt':12A,29B,79B,176C 'crash':16A 'cve':18A,21A 'data':76B,169C 'databas':59B,64B,111C,158C 'defin':143C 'driver':5A,38B,101C,125C,183C 'fix':49B,118C,138C 'fixed-s':48B 'fixed-width':117C 'form':129C 'influenc':71B,165C 'interfac':142C 'limit':56B,148C 'long':43B 'longer':135C 'make':85B 'may':78B,102C,175C 'memori':14A,28B,80B,177C 'memory-corrupt':27B 'mongodb':1A,30B,34B,97C 'odbc':4A,31B,37B,100C,141C 'out-of-bound':6A,90C 'outsid':171C 'over-long':41B 'overflow':75B 'packag':32B 'part':72B,166C 'particular':110C 'privileg':69B,163C 'produc':126C 'real':155C 'retriev':62B,114C 'side':122C 'size':50B,55B,156C 'sql':3A,26B,36B,99C 'target':123C,139C,153C,173C 'termin':87B,189C 'text':44B 'textual':128C 'trigger':104C 'type':60B,112C 'unexpect':88B,190C 'use':181C 'user':65B,159C 'valu':45B,107C,132C 'width':119C 'without':53B,147C 'write':10A,39B,68B,94C,162C 'written':170C","nicknames":[],"mitigations":[],"who_affected":"Applications that connect to MongoDB Atlas through the MongoDB Atlas SQL ODBC Driver and retrieve values of the affected database types into fixed-width client buffers are exposed. The risk requires a database user with basic write privileges, so teams that do not use this driver or whose database users are tightly restricted can likely skip it. unknown for the exact affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["atlassql","high","memorycorruption","mongodb","odbc","package"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120952","severity":null,"published_at":"2026-11-03T21:17:04+00:00","modified_at":"2026-11-03T21:17:04+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","fetched_at":"2026-11-03T21:19:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120952:1570","url":null,"severity":null,"published_at":"2026-11-03T21:24:00+00:00","modified_at":"2026-11-03T21:24:00+00:00","first_seen_at":"2026-11-03T21:24:00+00:00","fetched_at":"2026-11-03T21:24:00+00:00","note":"Description confirmed via Rapid7 (CVSS 3.1 7.1, AV:N/PR:L). MongoDB changelog (read 2026-11-03) does not list this CVE; no vendor advisory with affected/fixed ODBC versions found. Latest ODBC is 3.0.0 (Sep 29 2026), but whether it fixes this is unconfirmed. NVD page returned nothing via web-cli. Nothing verified. Settle by reading the MongoDB alerts page or the CVE record for the affected range."}],"documents":[{"id":60958,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-120952/","title":"Rapid7: CVE-2026-120952","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":60959,"url":"https://www.mongodb.com/docs/sql-interface/changelog","title":"MongoDB SQL Interface Changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}