CVE-2026-96746: fallo de gravedad alta en MongoDB C Driver
Heap buffer overflow via mid-scan command list growth in client topology monitoring
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.3epss 0.5%
An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Productos afectados
MongoDB · C DriverCVEs relacionadas — MongoDB C Driver
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-120678HIGHMongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)EPSS 0.4%CVE-2026-120955HIGHMongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS MetadataEPSS 0.4%CVE-2026-120684MEDIUMMongoDB C Driver GridFS gap lets a shared writer recover a protected client's passwordEPSS 0.3%CVE-2026-84963MEDIUMSilent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parserEPSS 0.3%CVE-2026-81524MEDIUMCross-tenant database retargeting via dot/NUL injection in namespace strings in the C DriverEPSS 0.3%CVE-2026-106428MEDIUMOut-of-bounds read in SCRAM response parsing in MongoDB C DriverEPSS 0.3%