CVE-2026-19003
Last modified
CVE-2026-19003 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mongodb | Bi Connector Odbc Driver | >= 1.0.0, < 1.4.9 |
References
- https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.9Vendor Advisory, Release Notes
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-19003?
How severe is CVE-2026-19003?
How do I fix CVE-2026-19003?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-18997A vulnerability was found in cosmicstack-labs mercury-agent …6.3
- CVE-2026-18998A vulnerability was determined in cosmicstack-labs mercury-a…6.3
- CVE-2026-1900The Link Whisper Free WordPress plugin before 0.9.1 has a pu…6.5
- CVE-2026-19000A vulnerability was identified in JeecgBoot up to 3.9.2. The…7.3
- CVE-2026-19001The MongoDB BI Connector ODBC Driver may write outside the b…9.8
- CVE-2026-19002A missing bounds check when parsing stored procedure paramet…8.1
- CVE-2026-19004An application using the MongoDB BI Connector ODBC Driver ma…8.1
- CVE-2026-19005A vulnerability was detected in nanocoai NanoClaw up to 2.0.…6.3
- CVE-2026-19006A vulnerability was found in mf-yang openclaw-cn 2026.2.5. T…6.3
- CVE-2026-19007A vulnerability was determined in mf-yang openclaw-cn up to …6.3
- CVE-2026-19008A vulnerability was identified in mf-yang openclaw-cn up to …6.3
- CVE-2026-19009A weakness has been identified in TinyAGI 0.0.20. This issue…7.3
Are you affected by CVE-2026-19003?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST