Integer Underflow Vulnerability in Libbson Affects MongoDB Software

CVE-2026-93395

What is CVE-2026-93395?

A vulnerability in libbson arises from the absence of lower-bound validation in the bson_new_from_buffer() function. This flaw allows for an integer underflow during the processing of BSON data that has a zero-length prefix. The function attempts to read a 32-bit document length from the input buffer but fails to ensure that this value is at least 5, the minimum allowable length for a valid BSON document. When this length field is zero, it leads to an expression that checks the null terminator wrapping around to UINT32_MAX, resulting in a potential heap out-of-bounds read that can crash the application. An attacker could exploit this vulnerability by sending crafted BSON input to any application that relies on this API, potentially causing a denial of service.

References