MongoDB C++ Driver CVE-2026-84970

The consuming application must pass externally-controlled text to the MongoDB C++ Driver's BSON library JSON parsing interface. The triggering condition is a document whose size crosses an integer type boundary - only very large inputs trigger the truncation. No MongoDB server, credentials, or non-default driver configuration are required. Exploitation is limited to scenarios where: (1) the application accepts user-supplied JSON without enforcing a document-size cap before invoking the parser, and (2) the attacker can deliver a payload large enough to reach the integer boundary, which may require bypassing upstream size limits such as HTTP body-size caps, reverse-proxy limits, or load-balancer request limits. The impact is confined entirely to the process embedding the library; the MongoDB server and other systems are not directly reachable through this flaw.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H) is broadly credible: AT:P (attack requirements present) correctly captures the need for a very large input document to trigger the integer boundary condition, VA:H correctly identifies process termination as the primary impact, and VC:L/VI:L capture the secondary OOB-read and partial-parse risks. The AV:L classification reflects a library-consumer trust boundary rather than direct network exposure to the driver itself, though in practice applications that accept network JSON and forward it to the parser are effectively network-reachable attack surfaces. EPSS data is absent from available intelligence, and KEV status is not confirmed, so exploitation urgency cannot be estimated from those signals - no public exploit has been identified at time of analysis. Even a mid-sized municipal IT team in olsztyn running an application that passes user-supplied JSON through this driver should treat this as a moderate-priority remediation rather than an emergency: the DoS (crash) outcome is the most realistic exploitation path, confidentiality and integrity impacts are secondary and require specific conditions (caller-side exposure of OOB data or ingestion of silently malformed documents into a pipeline). The overall risk is real but bounded - the blast radius is confined to the consuming process, not the MongoDB server.

An attacker submits a crafted, oversized JSON payload through a network-exposed API endpoint of an application that uses the MongoDB C++ Driver to parse incoming documents. The BSON library's integer truncation computes an incorrect buffer boundary, causing it to read beyond the allocated input, potentially exposing heap memory contents in an error response, or immediately crashing the application process and causing a service outage.