Strix
73.8K

CVE-2026-120959

LOWCVSS 3.7/10

Last modified

CVE-2026-120959 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process.

Description

A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.

Metrics

CVSS 3.1
3.7/10

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L

CVSS 4.0
2.1/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
MongoDBAtlas SQL>= 1.3.0, < 3.0.1

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-120959?
A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.
How severe is CVE-2026-120959?
CVE-2026-120959 has a CVSS score of 3.7/10 (LOW severity).
How do I fix CVE-2026-120959?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-120959?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST