CVE-2026-84966
mediumAn incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly.
Vendor / product: Mongodb — c\+\+ driver
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.
CVSS
5.5
5.5 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-09-03 16:18
Modified: 2026-09-22 15:54
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 06:50 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
mongodb / c\+\+_driver ≥3.0.0 <4.5.2
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://jira.mongodb.org/browse/CXX-3548
References
- https://jira.mongodb.org/browse/CXX-3548 cna@mongodb.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:50 UTC · record ↗