CVE-2026-84966mediumCWE-681

CVE-2026-84966: fallo de gravedad media en MongoDB C++ Driver

BSON element injection via NUL-embedded document keys in builder append

Publicada el

Seguir esta CVE+ Monitorear C Driver+ Monitorear mongo-cxx-driver

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.9epss 0.1%
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
MongoDB · C++ Driver
CVEs relacionadas — MongoDB C++ Driver

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-81522HIGHCross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ DriverEPSS 0.5%CVE-2026-88034MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ DriverEPSS 0.5%CVE-2026-106430MEDIUMQuery and rename target confusion via embedded NUL truncation in MongoDB C++ DriverEPSS 0.2%CVE-2026-84970MEDIUMHeap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parserEPSS 0.1%