---
id: "CVE-2026-120959"
kind: "vulnerability"
aliases: ["CVE-2026-120959"]
title: "MongoDB Atlas SQL ODBC Driver: memory overflow when reading query results"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["atlas-sql", "linux", "mongodb", "odbc", "other", "windows"]
not_affected_if: ["no-atlas-sql-odbc-driver", "single-row-fetch"]
published_at: "2026-11-03T21:17:04+00:00"
first_seen_at: "2026-11-03T21:19:08+00:00"
updated_at: "2026-11-03T21:20:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120959", "first_seen_at": "2026-11-03T21:19:08+00:00"}]
---

# MongoDB Atlas SQL ODBC Driver: memory overflow when reading query results

A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can let query return values be written past the end of a buffer in the calling application. An attacker who can influence those returned values may corrupt client memory or crash the client process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether an application uses the MongoDB Atlas SQL ODBC Driver to query data (unknown whether the sources name a version range or driver file to inspect)
- Check whether the application requests several result rows at once through bulk or array fetching, the condition the description says is required

## Timeline

- 2026-11-03T21:19:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120959

## From the sources

A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_