MongoDB C Driver CVE-2026-84965

Exploitation requires the target application to be compiled using a toolchain or configuration where size_t (or the equivalent size type used in the BSON library) is 32 bits - on 64-bit platforms with standard toolchains this condition is typically not met, effectively excluding the vast majority of modern server deployments. The attacker must be able to supply a JSON document of sufficient size to overflow a 32-bit accumulator to the application's BSON JSON parsing path; this limits the attack to applications that accept externally supplied JSON without enforcing a size cap upstream. No authentication is required. The impact is limited to denial of service - no code execution or data exfiltration path is described.

The vendor-assigned CVSS 4.0 score of 5.9 (AV:L/AC:H/AT:P/PR:N) correctly captures the meaningful constraints: high attack complexity, a specific prerequisite (32-bit size build), and no confidentiality or integrity impact. The 32-bit build requirement is the dominant limiting factor - the vast majority of modern server deployments compile with 64-bit size types, where the wraparound cannot occur. For the affected build profile, the attack is a remote DoS: no authentication is required and no user interaction is needed, but successfully triggering the wrap requires crafting a JSON document large enough to overflow a 32-bit accumulator, which demands non-trivial input engineering. No CISA KEV listing, no public proof-of-concept, and no EPSS data were provided. Real-world priority for organizations running 64-bit builds of the MongoDB C Driver is low; organizations using 32-bit-compiled C Driver deployments should treat this with higher urgency given the unauthenticated, availability-disrupting nature of the impact.

An attacker with access to any network-facing application that embeds the MongoDB C Driver's BSON library on a 32-bit-size build sends an HTTP request or other protocol message containing a crafted JSON payload engineered to be large enough to cause the allocation-size calculation to wrap around. The library frees the undersized buffer and then writes into the freed memory, corrupting the heap and causing the host application process to crash, achieving unauthenticated remote denial of service. No public proof-of-concept has been identified at time of analysis.