{"id":"CVE-2026-120959","kind":"vulnerability","aliases":["CVE-2026-120959"],"related":[],"title":"MongoDB Atlas SQL ODBC Driver: memory overflow when reading query results","description":"A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.","summary":"A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can let query return values be written past the end of a buffer in the calling application. An attacker who can influence those returned values may corrupt client memory or crash the client process.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["atlas-sql","linux","mongodb","odbc","other","windows"],"not_affected_if":["no-atlas-sql-odbc-driver","single-row-fetch"],"how_to_check":"- Check whether an application uses the MongoDB Atlas SQL ODBC Driver to query data (unknown whether the sources name a version range or driver file to inspect)\n- Check whether the application requests several result rows at once through bulk or array fetching, the condition the description says is required","fix":null,"status":"open","published_at":"2026-11-03T21:17:04+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","triaged_at":"2026-11-03T21:20:48+00:00","updated_at":"2026-11-03T21:20:48+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T21:20:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"MongoDB Atlas SQL ODBC Driver: memory overflow when reading query results","impact":"medium","summary":"A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can let query return values be written past the end of a buffer in the calling application. An attacker who can influence those returned values may corrupt client memory or crash the client process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["mongodb","odbc","atlas-sql","windows","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Client process memory corrupted or crashed by attacker-influenced query results","analyst_note":"Find the affected and fixed driver versions and the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-120959; the sources give no version or fix.","how_to_check":"- Check whether an application uses the MongoDB Atlas SQL ODBC Driver to query data (unknown whether the sources name a version range or driver file to inspect)\n- Check whether the application requests several result rows at once through bulk or array fetching, the condition the description says is required","plain_action":"","needs_analyst":true,"not_affected_if":["no-atlas-sql-odbc-driver","single-row-fetch"],"who_is_affected":"Applications that query MongoDB Atlas SQL through the ODBC driver and fetch multiple result rows at once are the ones the description points to. The sources do not say which driver versions are affected or what the vendor fixed, so the exposure boundary is unknown. Teams that do not use this driver can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000725,"input_tokens":4177,"output_tokens":614,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-120959':14A,17A '-2026':13A,16A 'abl':107C 'applic':54B,104C,128C,154C 'application-chosen':153C 'atlas':2A,19B,34B,80C 'atlas-sql':18B 'attack':56B 'bound':96C 'buffer':50B,99C 'call':53B,103C 'caus':85C,116C 'chosen':155C 'client':65B,70B,127C,144C 'condit':148C 'corrupt':64B 'crash':68B 'cve':12A,15A 'data':117C 'depend':149C 'driver':5A,37B,83C 'end':47B 'flaw':30B,76C 'handl':29B,75C 'influenc':59B,109C 'let':39B 'linux':21B 'locat':124C 'may':63B,115C,132C 'memori':6A,28B,66B,74C,130C,139C 'memory-handl':27B,73C 'modif':136C 'mongodb':1A,22B,33B,79C 'odbc':4A,23B,36B,82C 'outsid':94C 'overflow':7A 'parti':106C 'past':45B 'place':120C 'process':71B,145C 'provid':100C 'queri':10A,40B,90C,113C 'reach':146C 'read':9A 'request':158C 'result':11A,133C,160C 'return':41B,61B,87C,114C 'row':161C 'sever':159C 'specif':152C 'sql':3A,20B,35B,81C 'termin':141C 'unintend':123C,135C 'valu':42B,62B,86C,111C 'way':156C 'window':25B 'written':44B,93C","nicknames":[],"mitigations":[],"who_affected":"Applications that query MongoDB Atlas SQL through the ODBC driver and fetch multiple result rows at once are the ones the description points to. The sources do not say which driver versions are affected or what the vendor fixed, so the exposure boundary is unknown. Teams that do not use this driver can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["atlassql","linux","low","mongodb","odbc","other","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120959","severity":null,"published_at":"2026-11-03T21:17:04+00:00","modified_at":"2026-11-03T21:17:04+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","fetched_at":"2026-11-03T21:19:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}