Numeric Type Conversion Vulnerability in MongoDB C++ Driver

CVE-2026-84966

What is CVE-2026-84966?

A numeric type conversion flaw within the BSON document building component of the MongoDB C++ Driver could lead to unexpected behavior. Specifically, when an application inputs an excessively large, non-terminated field name, the library may improperly interpret the length value. This situation may cause the driver to access memory regions beyond the intended buffer, leading to abnormal termination of the process. The issue arises without the need for authentication, provided the oversized name is transmitted in a specific manner.

References