CVEFinder.io

CVE-2026-84969

ℹī¸ low
Summary

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

CVSS Score
3.7
Low
EPSS Score
0.2
Exploit Probability
Published Date
2026-09-03
First Seen: 2026-09-04
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 3.9% of all 365,968 vulnerabilities in our database.

#351,809
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Sep 3, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-09-10
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)
CWE-787

đŸ“Ļ Affected Products 2

Vendor Product Status Affected Versions
mongodb c_driver Affected
> 1.30.0 < 1.30.9
mongodb c_driver Affected
> 2.0.0 < 2.5.2

🔗 References 1

https://jira.mongodb.org/browse/CDRIVER-6410
Vendor Advisory Issue Tracking

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-93393 ⚠ī¸ high 8.1 0.5 A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platf... 2026-09-17
CVE-2026-93394 ℹī¸ low 3.7 0.3 A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and... 2026-09-17
CVE-2026-93395 đŸ”ļ medium 5.3 0.4 A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when proc... 2026-09-17
CVE-2026-88035 đŸ”ļ medium 4.7 0.1 A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-... 2026-09-10
CVE-2026-88036 ⚠ī¸ high 8.3 0.3 Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can caus... 2026-09-10
CVE-2026-84963 đŸ”ļ medium 5.3 0.3 An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusua... 2026-09-03
These CVEs affect the same products