CVE-2026-84969
published 2026-09-03CVE-2026-84969: A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a…
PriorityP416low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.27%
18.3th percentile
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | c_driver | >= 1.30.0 < 1.30.9 | 1.30.9 |
| mongodb | c_driver | >= 2.0.0 < 2.5.2 | 2.5.2 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB C Driver up to 1.30.8/2.5.1 BSON-to-JSON Conversion Helpers heap-based overflow (Nessus ID 342829 / WID-SEC-2026-3182)
vuldb·2026-09-05·CVSS 3.7
CVE-2026-84969 [LOW] MongoDB C Driver up to 1.30.8/2.5.1 BSON-to-JSON Conversion Helpers heap-based overflow (Nessus ID 342829 / WID-SEC-2026-3182)
A vulnerability marked as problematic has been reported in MongoDB C Driver up to 1.30.8/2.5.1. This impacts an unknown function of the component BSON-to-JSON Conversion Helpers. Performing a manipulation results in heap-based buffer overflow.
This vulnerability is identified as CVE-2026-84969. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is
ghsa_unreviewed·2026-09-03
CVE-2026-84969 [MEDIUM] CWE-787 A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-03
Published