Cpe:2.3:a:mongodb:atlas_sql_odbc_driver:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amongodbatlas_sql_odbc_driver/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 00:25:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMongoDB Atlas SQL ODBC Driver: Out-of-bounds write (CVE-2026-120952)https://feed.craftedsignal.io/briefs/2026-11-mongodb-atlas-odbc-oob-write/Wed, 04 Nov 2026 00:25:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mongodb-atlas-odbc-oob-write/An out-of-bounds write vulnerability in the MongoDB Atlas SQL ODBC Driver allows a user with basic write privileges to trigger memory corruption and application crashes by manipulating database values retrieved into fixed-width buffers.The MongoDB Atlas SQL ODBC Driver contains an out-of-bounds write vulnerability (CVE-2026-120952). The flaw occurs when the driver retrieves database values into fixed-width client-side targets. The driver fails to validate the length of the textual representation of the data against the buffer size before copying, which leads to memory corruption. An attacker with basic database write privileges can influence the data written beyond the buffer boundaries.

Impact

Successful exploitation can lead to unexpected application termination (Denial of Service) or potential memory corruption within the client application utilizing the driver.

Recommendation

  • Inventory systems and applications utilizing the MongoDB Atlas SQL ODBC Driver.
  • Monitor for application crashes or memory access violations involving the MongoDB ODBC Driver components on client-side hosts.
  • Contact the vendor for available security patches or updates addressing CVE-2026-120952.
]]>highadvisoryvulnerabilitymemory-corruptionodbc