CVE-2026-18888
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The MongoDB BI Connector ODBC Driver converts floating point column values to text without checking if the result fits in the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could crash the application performing the read.
Risk Assessment
Risk of application crash (denial of service) due to memory corruption, potentially affecting system availability.
Recommendation
Update MongoDB BI Connector ODBC Driver to a version that includes the buffer size check fix.
Original NVD description (English source)
The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.