A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.

CVE-2026-81532 describes a stack-based buffer overflow vulnerability in the MongoDB Connector for BI ODBC driver. An attacker who can submit SQL through an application using this driver can craft a positioned-cursor statement with an excessively long cursor name. Because the driver does not validate the length of the cursor name before constructing its diagnostic message, memory adjacent to an internal fixed-length buffer is overwritten with user-supplied content. This can cause the hosting application process to crash (denial of service) and potentially allows arbitrary code execution within the process context. The vulnerability requires the ability to submit SQL through an application leveraging the affected ODBC driver. A fix or patched release is referenced via the MongoDB BI Connector ODBC driver GitHub releases page.