Heap-Based Buffer Overflow in MongoDB C Driver on Windows Platform

CVE-2026-93393

What is CVE-2026-93393?

A vulnerability exists in the MongoDB C Driver's TLS transport layer for the Windows platform, allowing a remote endpoint to exploit a heap-based buffer overflow. This occurs when the driver processes incoming encrypted traffic, potentially allowing an attacker to manipulate the connection, which leads to writing data outside the allocated memory bounds. Since the vulnerability can be triggered before any application-level authentication, no user interaction is required. Exploitation may result in memory corruption, disclosure of adjacent memory, or even termination of the client process.

References