AIKIDO-2026-197332

mongodb.mongo-c-driver is vulnerable to Heap-based Buffer Overflow

Heap-based Buffer OverflowCVE-2026-84969 Published 3 days ago

Medium Risk

This Affects:

mongodb.mongo-c-driver

1.30.0 - 1.30.8

Fixed in 1.30.9

2.0.0 - 2.5.1

Fixed in 2.5.2

Are you affected? Scan for Free

TL;DR

libbson converts BSON binary fields to JSON by base64-encoding them, and when the JSON output is cut short at a caller-configured length the encoder writes the full encoded remainder instead of the truncated length. The base64 path in common-string.c copies remainder_encoded_len bytes past the destination buffer, corrupting heap memory immediately after the target buffer. Document content passed into the conversion controls the overwritten bytes, giving a limited integrity impact. The fix copies only the truncated remainder length that fits the destination buffer.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application produces length-truncated JSON output (for example driver logging) that contains BSON binary fields.