CVE-2026-84970 in C++ Driver
Summary
by MITRE • 09/03/2026
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in the MongoDB C++ Driver's BSON library represents a critical numeric truncation weakness within its JSON parsing component. This flaw arises from improper handling of large input data during the conversion or validation processes, leading to integer overflow or truncation errors when calculating buffer sizes or offsets. Specifically, an attacker who controls the text passed to the public JSON parsing interface can exploit this logic error by providing a payload that is sufficiently large to trigger the miscalculation. The core technical issue lies in the failure of the library to properly validate numeric bounds before performing memory operations based on those values. When the input exceeds certain thresholds, the internal arithmetic wraps around or truncates, resulting in significantly smaller allocated buffers than required for the actual data size. This discrepancy creates a classic buffer over-read condition where the application attempts to access memory locations beyond the boundaries of the supplied buffer.
The operational impact of this vulnerability is severe and multifaceted, affecting the integrity, confidentiality, and availability of any process utilizing the affected library. Because no MongoDB server connection, credentials, or non-default configuration are required, the attack surface is broadened significantly; any application that parses JSON input using this driver becomes a potential target. The immediate consequences include reading sensitive memory contents beyond the intended buffer boundary. This out-of-bounds read can lead to information disclosure, where an attacker retrieves arbitrary data from the process's memory space, potentially exposing secrets such as encryption keys, session tokens, or other proprietary logic. Furthermore, the vulnerability allows for silent acceptance of partial input as a complete document. In this scenario, the parser truncates the logical structure without raising an error, leading to data corruption and potential business logic flaws downstream in the application stack where incomplete or malformed documents are processed as valid entities.
In addition to information disclosure and data integrity issues, the vulnerability poses a direct threat to system availability. The miscalculated memory access can trigger segmentation faults or other critical errors that cause the process hosting the MongoDB C++ Driver to terminate unexpectedly. This denial of service effect is particularly dangerous in high-throughput environments where such parsing occurs frequently, as it can lead to cascading failures if not properly isolated within microservices or worker processes. The fact that this behavior is confined to the local process does not mitigate its severity; rather, it highlights the importance of securing client-side libraries and drivers against untrusted input, a principle often overlooked in favor of server-side protections.
From a classification perspective, this vulnerability aligns with CWE-190: Integer Overflow or Wraparound, which describes situations where an integer calculation results in a value that is too large for the data type to represent, leading to unexpected behavior such as buffer overflows or truncations. It also relates closely to CWE-787: Out-of-bounds Read, as the direct consequence of the numeric error is accessing memory outside the allocated bounds. In terms of offensive security frameworks, this vulnerability can be leveraged within ATT&CK technique T1059: Command and Scripting Interpreter if the parsed JSON triggers further execution flows, or more directly under T1074: Data Staged for Exfiltration if used to stage data in memory before leaking it. Mitigation strategies must focus on rigorous input validation at the boundary of the public API. Developers should ensure that all numeric inputs are validated against maximum allowable limits before being passed to internal parsing functions. Implementing strict length checks and using safe arithmetic operations that detect overflow conditions is essential. Additionally, upgrading to a patched version of the MongoDB C++ Driver where these bounds checking mechanisms have been corrected is the primary remediation path for organizations relying on this library.