Live › vulnerability › CVE-2026-120959
A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can let query return values be written past the end of a buffer in the calling application. An attacker who can influence those returned values may corrupt client memory or crash the client process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Applications that query MongoDB Atlas SQL through the ODBC driver and fetch multiple result rows at once are the ones the description points to. The sources do not say which driver versions are affected or what the vendor fixed, so the exposure boundary is unknown. Teams that do not use this driver can skip it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.
This page as .md · .json · in your agent: get_signal("CVE-2026-120959")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.