Integer Wraparound Vulnerability in BSON Library Affecting MongoDB

CVE-2026-84965

What is CVE-2026-84965?

The BSON library exhibits an integer wraparound vulnerability during allocation size calculations in its JSON parsing functionality. This flaw allows an attacker to exploit the library by supplying an excessively large JSON input to any linked application. In systems utilizing 32-bit size configurations, this can trigger an unexpected termination of the application due to a buffer being released while a subsequent write operation attempts to use a stale pointer. This scenario can lead to denial of service, creating a potential risk to application availability.

References