CVE-2026-106437mediumCWE-191

CVE-2026-106437: fallo de gravedad media en MongoDB C Driver

Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

Publicada el

Seguir esta CVE+ Monitorear C Driver+ Monitorear mongo-c-driver

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.9epss 0.1%
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Productos afectados
MongoDB · C Driver
CVEs relacionadas — MongoDB C Driver

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-96746HIGHHeap buffer overflow via mid-scan command list growth in client topology monitoringEPSS 0.4%CVE-2026-120678HIGHMongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)EPSS 0.4%CVE-2026-120955HIGHMongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS MetadataEPSS 0.4%CVE-2026-120684MEDIUMMongoDB C Driver GridFS gap lets a shared writer recover a protected client's passwordEPSS 0.3%CVE-2026-84963MEDIUMSilent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parserEPSS 0.3%CVE-2026-84969MEDIUMHeap overflow via truncated base64 encoding of binary fields in length-limited JSON outputEPSS 0.3%