CVE-2026-81532

CVE-2026-81532 is a buffer overflow (CWE-121) in the MongoDB Connector for BI ODBC driver: cursor names in positioned-cursor SQL statements are not length-checked before the driver copies them into a fixed-length internal buffer while constructing a diagnostic message. An attacker needs only low privileges — any user who can submit SQL through an application that uses this ODBC driver — and triggers the flaw by sending a positioned-cursor statement with an over-long cursor name. The resulting overwrite of adjacent memory can crash the hosting application process and may also allow unintended code to run within it. Only deployments that use the Connector for BI's ODBC driver — typically BI and analytics integrations that issue SQL against MongoDB over ODBC — are affected; the data provided names no other MongoDB products or version ranges. No proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no active exploitation is known at this time.

What to do: Inventory whether any applications or BI-tool integrations connect to MongoDB through the Connector for BI ODBC driver, and upgrade the driver to a patched release once MongoDB publishes fixed versions (no version numbers are available in the data at hand). In the meantime, restrict SQL submission to trusted low-privilege users and cap or validate cursor-name lengths in application code, and alert on crashes of processes hosting the driver.