Read the docs
TI-2026-69713 Aliases CVE-2026-106437

Out-of-bounds memory access in MongoDB C Driver BSON buffers

Priority LOW 25CWE-191Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The MongoDB C Driver from 1.4.0 before 1.30.13 and from 2.0.0 before 2.5.6 can record a buffer length below the five-byte BSON minimum (CWE-191). Later operations underflow unsigned length calculations and access memory outside the document buffer. An actor who can influence the length the application supplies can crash it or read or corrupt adjacent process memory after the application passes an undersized value to bson_reserve_buffer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00134 2nd percentileScored 2026-11-07
Fix Fixed C Driver (MongoDB): 1.30.13, 2.5.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBC Driver1.4.0 to before 1.30.13; 2.0.0 to before 2.5.61.30.13, 2.5.6Patch availableCNA
  • C Driver VendorMongoDB Affected 1.4.0 to before 1.30.13; 2.0.0 to before 2.5.6 Fixed in 1.30.13, 2.5.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*1.4.0 to before 1.30.13; 2.0.0 to before 2.5.6VulnerableMongoDB
  • cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:* Versions 1.4.0 to before 1.30.13; 2.0.0 to before 2.5.6 Vulnerable ·MongoDB

Remediation

Upgrade MongoDB C Driver to 1.30.13 in the 1.x branch or to 2.5.6 in the 2.x branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA C Driver (MongoDB) Fixed in 1.30.13, 2.5.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MongoDB C Driver 1.30.13, 2.5.6

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-69710 One-byte heap buffer overflow in MongoDB C Driver BSON bulk writerPriority LOW 25
    • TI-2026-69714 Silent Decimal128 value corruption in MongoDB C DriverPriority LOW 22
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-106437
  2. 2026-10-10 Affected versions changed · Red Hat
  3. 2026-10-10 CVSS score added · Red Hat
  4. 2026-10-27 CVSS score added · NVD

References

Advisory 1

  • TI-2026-62966 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream CVSS 4.0CRITICAL 9.2
  • TI-2026-05870 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow CVSS 4.0HIGH 8.6
  • TI-2026-62968 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() CVSS 4.0MEDIUM 6.9
  • TI-2024-07001 Accessing Untrusted Directory May Allow Local Privilege Escalation CVSS 3.1HIGH 7.8
  • TI-2026-58387 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client CVSS 4.0HIGH 8.2
  • TI-2023-00414 MongoDB client C Driver may infinitely loop when validating certain BSON input data CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences