EUVD-2026-82471
GHSA-jm9m-v7jc-m4j8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote crafted input (AV:N/AC:L/PR:N/UI:N) via a widely reachable parsing API; impact is a single-process crash from an OOB read, so A:L and C:N/I:N.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.
AnalysisAI
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an application that parses attacker-controlled BSON input through libbson's bson_new_from_buffer() API; the malicious input specifically needs a document length field of zero (below the 5-byte BSON minimum) to trigger the underflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but limited-severity denial-of-service issue, not a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is specified in the provided intelligence; check the MongoDB Jira issue CDRIVER-6343 and the MongoDB C Driver release notes for a fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Heap-based buffer overflow in the TLS transport layer of the MongoDB C Driver on Windows TLS-backend builds allows the e
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress s
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthentica
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are
Heap buffer out-of-bounds write in the MongoDB C Driver's BSON-to-JSON conversion helpers allows an unauthenticated part
SCRAM authentication in the MongoDB C Driver (libmongoc) fails to abort when a nonce mismatch is detected in the server'
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cau
GridFS NoSQL injection in the MongoDB C Driver (libmongoc) enables authenticated users with influence over file identifi
Same weakness CWE-191 – Integer Underflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today