Dashboard / CVE-2026-19004

CVE-2026-19004

HIGH
MEDIUM Priority: 0.04 BB Relevance: 58/100
Published: 2026-08-12 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Active
S: X
AT: Present
VC: High
VI: High
VA: High

Description

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
mongodb bi_connector_odbc_driver < 1.4.9

References & Advisories (1)

Bug Bounty Relevance

58 / 100
✓ Network accessible
✓ No authentication

CVSS Score

8.8 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.50%
Raw Score 0.005000
Percentile 42.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00500
2026-10-28
0.00500

Intelligence Sources

nvd ref →

External Links