MongoDB C Driver EUVD-2026-95153

Exploitation is NOT possible against the library in isolation or default usage. It requires an embedding C/C++ application to (1) pass a length smaller than the five-byte BSON document minimum to bson_reserve_buffer, and (2) subsequently perform an affected append or comparison operation on that buffer. Critically, the attacker must be able to influence the length value the application supplies to the API - so exploitability depends on the application forwarding externally-derived or attacker-controlled sizes into the reservation call. Limiting factors: the local attack vector (AV:L) and the attack-requirement precondition (AT:P) mean this cannot be triggered remotely against a stock configuration; impact is dominated by denial of service (process termination) with only limited memory read/corruption, and no privileges or user interaction are otherwise needed beyond the vulnerable code path existing.

This is a moderate-severity, condition-dependent memory-safety flaw (CWE-191 integer underflow) in the MongoDB C Driver's BSON buffer-reservation API, and the available signals converge on 'real but low-urgency.' The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N) scores 5.9 and is internally consistent with the description: AV:L reflects that this is a library memory-corruption bug triggered through the embedding application rather than a directly network-reachable service, and AT:P captures the explicit precondition that the application must pass an undersized length to bson_reserve_buffer and then perform an affected append/comparison operation. Impact skews toward availability (VA:H - application termination) with only low confidentiality/integrity impact (VC:L/VI:L - reading or corrupting adjacent process memory), so this is primarily a crash/DoS and opportunistic memory-disclosure/corruption issue rather than a clean RCE. There is no CISA KEV listing, no public exploit identified, and no EPSS score provided in the input, so there is currently no evidence of exploitation or widespread interest. The key caveat: although PR:N marks this 'unauthenticated,' real exploitability is gated entirely by whether a given embedding application forwards attacker-influenced lengths into the reservation API - a flaw in the library that most correctly-written applications will never expose. Treat this as a dependency-hygiene patch (update libmongoc/libbson) rather than an emergency, while auditing any in-house code that passes externally-derived sizes to bson_reserve_buffer.

An application built on the MongoDB C Driver computes a BSON buffer size from attacker-influenced input and passes a value below the five-byte BSON minimum to bson_reserve_buffer. When the application subsequently performs an append or comparison, the undersized length underflows an unsigned calculation, causing an out-of-bounds read/write that crashes the process or corrupts adjacent memory. No public exploit code has been identified at time of analysis; the vector is local (AV:L) and requires the application to use the API in the vulnerable pattern.