CVE-2026-93393criticalCWE-787

CVE-2026-93393: fallo crítico en MongoDB Inc. C Driver

Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear C Driver+ Monitorear mongo-c-driver

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.2epss 0.5%
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
MongoDB Inc. · C Driver
CVEs relacionadas — MongoDB Inc. C Driver

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-93395MEDIUMInteger Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()EPSS 0.4%CVE-2026-93394MEDIUMlibmongoc SCRAM client nonce-validation bypassEPSS 0.3%CVE-2026-6231MEDIUMbson_validate may skip validation when processing certain inputsEPSS 0.2%