MongoDB Atlas SQL ODBC Driver: Out-of-bounds write (CVE-2026-120952)
An out-of-bounds write vulnerability in the MongoDB Atlas SQL ODBC Driver allows a user with basic write privileges to trigger memory corruption and application crashes by manipulating database values retrieved into fixed-width buffers.
CVE search metadata
CVE search record: CVE-2026-120952. Severity: high. CVSS: 7.1. KEV: no. Product: Atlas SQL ODBC Driver. Brief: MongoDB Atlas SQL ODBC Driver: Out-of-bounds write (CVE-2026-120952). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mongodb-atlas-odbc-oob-write/
Triage facts
Revision 1- Applicability
- Atlas SQL ODBC Driver
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 00:25 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
The MongoDB Atlas SQL ODBC Driver contains an out-of-bounds write vulnerability (CVE-2026-120952). The flaw occurs when the driver retrieves database values into fixed-width client-side targets. The driver fails to validate the length of the textual representation of the data against the buffer size before copying, which leads to memory corruption. An attacker with basic database write privileges can influence the data written beyond the buffer boundaries.
Impact
Successful exploitation can lead to unexpected application termination (Denial of Service) or potential memory corruption within the client application utilizing the driver.
Recommendation
- Inventory systems and applications utilizing the MongoDB Atlas SQL ODBC Driver.
- Monitor for application crashes or memory access violations involving the MongoDB ODBC Driver components on client-side hosts.
- Contact the vendor for available security patches or updates addressing CVE-2026-120952.
Immediate actions
Identify and inventory all applications configured to use the MongoDB Atlas SQL ODBC Driver
Threat Hunt
Monitor client application logs or system event logs (e.g., Windows Event Viewer Application Log) for frequent process crashes or faults related to the MongoDB ODBC Driver
Data: Application crash logs, System event logs (Event ID 1000/1001 on Windows)
Mitigations
Apply vendor-supplied security patches for CVE-2026-120952 as soon as they become available
CVE-2026-120952