A stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows authenticated users to trigger memory corruption and potential remote code execution.

This vulnerability is a stack-based buffer overflow (CWE-121) caused by improper bounds checking on positioned-cursor statements. A user with low-level privileges can provide a cursor name that exceeds the internal buffer capacity, resulting in memory corruption.

Successful exploitation of this flaw could lead to unauthorized code execution within the context of the hosting application, potentially resulting in full system compromise. Given the CVSS score of 8.8, this vulnerability represents a high risk to data integrity and system availability, particularly for applications relying on this driver for data analysis or reporting.

Immediate Action: Update the MongoDB BI Connector ODBC Driver to version 1.4.10 or later as soon as the vendor release becomes available.

Proactive Monitoring: Monitor application logs for unusual cursor-related errors or repeated process crashes, which may indicate attempted exploitation.

Compensating Controls: Implement strict input validation or sanitization for all SQL queries submitted through the application to prevent the injection of oversized cursor names.

Public Exploit Available: No (exploit_available: false).

This vulnerability presents a significant risk due to the potential for remote code execution. Security teams should prioritize identifying all instances of the affected driver within their environment and prepare for an immediate update to the patched version once deployed. Testing should be performed in a staging environment to ensure compatibility before applying the update in production.