CVE Feed

    Dashboard / CVE / CVE-2026-96746

    CVE-2026-96746

    An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.

    Published:Sep 24, 2026
    Last Modified:Sep 24, 2026
    EPS:Sep 24, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Mongodb
    Product
    C Driver

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-120954 (CVSS 6.3) — A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wrapar…
    CVE-2026-120955 (CVSS 8.7) — The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under …
    CVE-2026-120956 (CVSS 7.1) — The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a que…
    CVE-2026-120684 (CVSS 6) — A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialize…
    CVE-2026-120678 (CVSS 8.7) — A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client libra…
    CVE-2026-114645 (CVSS 5.7) — A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause…
    CVE-2026-106438 (CVSS 5.1) — An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precisio…
    CVE-2026-106437 (CVSS 5.9) — The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON mi…
    CVE-2026-106431 (CVSS 5.9) — An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediate…
    CVE-2026-106428 (CVSS 6.3) — An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyon…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High