---
id: "CVE-2026-120952"
kind: "vulnerability"
aliases: ["CVE-2026-120952"]
title: "MongoDB Atlas SQL ODBC Driver: out-of-bounds write can corrupt client memory and crash apps"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["atlas-sql", "memory-corruption", "mongodb", "odbc", "package"]
not_affected_if: ["driver-not-used", "no-untrusted-db-writers"]
published_at: "2026-11-03T21:17:04+00:00"
first_seen_at: "2026-11-03T21:19:08+00:00"
updated_at: "2026-11-03T21:24:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120952", "first_seen_at": "2026-11-03T21:19:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:24:00+00:00"}]
---

# MongoDB Atlas SQL ODBC Driver: out-of-bounds write can corrupt client memory and crash apps

The MongoDB Atlas SQL ODBC Driver writes an over-long text value into a fixed-size client buffer without a size limit when certain database types are retrieved. A database user with basic write privileges can influence part of the overflowing data, which may corrupt memory in the application and make it terminate unexpectedly.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether an application uses the MongoDB Atlas SQL ODBC Driver (installed ODBC drivers list, or the driver name in DSN/connection strings), and note the driver version.
- Affected and fixed versions are unknown: MongoDB has not published them in the sources read. Watch https://www.mongodb.com/resources/products/alerts and the SQL Interface changelog; the latest ODBC release is 3.0.0.

## Timeline

- 2026-11-03T21:19:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120952
- 2026-11-03T21:24:00+00:00 analyst — Description confirmed via Rapid7 (CVSS 3.1 7.1, AV:N/PR:L). MongoDB changelog (read 2026-11-03) does not list this CVE; no vendor advisory with affected/fixed ODBC versions found. Latest ODBC is 3.0.0 (Sep 29 2026), but whether it fixes this is unconfirmed. NVD page returned nothing via web-cli. Nothing verified. Settle by reading the MongoDB alerts page or the CVE record for the affected range.

## Documents

- [describes] Rapid7: CVE-2026-120952 https://www.rapid7.com/db/vulnerabilities/cve-2026-120952/
- [mentions] MongoDB SQL Interface Changelog https://www.mongodb.com/docs/sql-interface/changelog

## From the sources

An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_