Off-by-One Error in MongoDB C Driver Exploits Buffer Vulnerability

CVE-2026-106431

What is CVE-2026-106431?

A critical vulnerability exists in the MongoDB C Driver due to an off-by-one error in the BSON bulk document writer. This flaw allows for the potential writing of a zero byte immediately beyond allocated heap memory when a document concludes at a specific buffer boundary. Exploitations can occur if an attacker influences the size of the serialized documents, causing memory corruption or potentially terminating the application process. To be vulnerable, the application must utilize the BSON bulk-writer API and produce an exact total document size.

References