An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.

CVE-2026-81533 describes a memory-safety vulnerability in the MongoDB BI Connector ODBC Driver. The flaw is triggered when a SQL statement contains an unusually long sequence of digits following a LIMIT clause. The vulnerability only manifests when the driver's optional prefetch setting is enabled. The root cause is the driver copying the digit sequence into a fixed-size internal buffer without performing bounds checking, constituting a classic buffer overflow condition. A user capable of influencing the numeric value of a LIMIT clause could exploit this to crash the hosting application process or corrupt adjacent memory. The impact includes potential denial of service and memory corruption, which could have further security implications. A patch or updated release is referenced via the MongoDB BI Connector ODBC Driver GitHub releases page.