CVE-2026-84969
Low
Description
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.
SeverityLow
CVSS3.7
Exploit probability—
Product
Mongodb C Driver
PublishedSep 3, 2026
First seenSep 3, 2026
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- mongodb c_driver1.30.9, 2.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb c_driver | 1.30.0 ≤ v < 1.30.9, 2.0.0 ≤ v < 2.5.2 | 1.30.9, 2.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.