CVE-2026-120952
Last modified
CVE-2026-120952 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size.
Description
An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Atlas SQL ODBC Driver | >= 0.0.1, < 3.0.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-120952?
How severe is CVE-2026-120952?
How do I fix CVE-2026-120952?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12091IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…5.3
- CVE-2026-12093The Simple Membership plugin for WordPress is vulnerable to …5.3
- CVE-2026-120930Incorrect authorization in Blink in Google Chrome prior to 1…5.4
- CVE-2026-120931Out of bounds write in WebGL in Google Chrome on on Android …9.6
- CVE-2026-12094The Advanced Contact Form 7 - Compact DB plugin for WordPres…5.3
- CVE-2026-12095The Kargo Takip plugin for WordPress is vulnerable to Server…7.2
- CVE-2026-120953A URI redirection weakness exists in the authentication comp…4.3
- CVE-2026-120954A weakness in the BSON library's handling of a specialized b…3.7
- CVE-2026-120955The GridFS file download API in the MongoDB C Driver does no…7.5
- CVE-2026-120956The MongoDB C Driver does not validate the type or format of…7.1
- CVE-2026-120959A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver …3.7
- CVE-2026-12097The User Management plugin for WordPress is vulnerable to au…5.3
Are you affected by CVE-2026-120952?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST