CVE-2026-18888: The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the

Routine

MEDIUM 6.5UPGRADE

CVE-2026-18888 is a medium-severity flaw (CVSS 6.5) affecting bi connector odbc driver. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	6.5 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.3% (top 77%)
CISA exploited list	No
Weakness	CWE-787
Published	2026-08-12
Last modified	2026-10-23

Publisher (CNA): MongoDB, Inc. · Vendor: mongodb

Am I affected?

Timeline

2026-08-12 21:17 UTCPublished CVE record published
2026-10-23 19:10 UTCUpdated Record last modified

mongodb bi connector odbc driver UPGRADE

Affected: >= 1.0.0 and < 1.4.9

Fixed in: 1.4.9

Safe to downgrade to: a release before 1.0.0

1. Check installed version

apt-cache policy bi-connector-odbc-driver || rpm -q bi-connector-odbc-driver || bi-connector-odbc-driver --version

2. UPGRADE to 1.4.9 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade bi-connector-odbc-driver

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade bi-connector-odbc-driver

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)

apt-cache madison bi-connector-odbc-driver sudo apt install bi-connector-odbc-driver=<VERSION_BEFORE_1.0.0> sudo apt-mark hold bi-connector-odbc-driver

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list bi-connector-odbc-driver sudo dnf downgrade bi-connector-odbc-driver-<VERSION_BEFORE_1.0.0> sudo dnf versionlock add bi-connector-odbc-driver

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-18888?

bi connector odbc driver: upgrade to 1.4.9. Exact commands for each OS are on this page.

Is CVE-2026-18888 being exploited?

CVE-2026-18888 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-18888 affect?

CVE-2026-18888 affects bi connector odbc driver. Severity is medium (CVSS 6.5). The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the drive

How urgent is CVE-2026-18888?

Priority 29/100. No elevated risk signals yet.

Software pages

MongoDB vulnerabilities

Related CVEs

CVE-2026-19001 CRITICAL 9.8 UPGRADE The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application s
CVE-2026-19004 HIGH 8.1 UPGRADE An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing
CVE-2026-19002 HIGH 8.1 UPGRADE A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Drive
CVE-2026-19003 HIGH 7.8 UPGRADE A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC D

References

← Back to latest CVEs