Memory Handling Error in MongoDB C Driver for BSON-to-JSON Conversion
CVE-2026-84969

6.3MEDIUM

Key Information:

Vendor

Mongodb
Status
C Driver
Vendor
CVE Published:
3 September 2026

What is CVE-2026-84969?

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver may allow an attacker to write beyond the end of a heap buffer. This occurs when a binary field is encoded, and the output is truncated at a caller-specified length. An unauthorized party can supply document content, potentially modifying data outside the designated buffer. This vulnerability highlights the importance of strict validation mechanisms and memory management practices to maintain data integrity.

Affected Version(s)

C Driver 1.30.0 < 1.30.9

C Driver 2.0.0 < 2.5.2

References

https://jira.mongodb.org/browse/CDRIVER-6410

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.