MongoDB C Driver up to 2.3.0 BSON Parsing bson_new_from_buffer length integer underflow

Summaryinfo

A vulnerability, which was classified as critical, was found in MongoDB C Driver up to 2.3.0. Affected by this vulnerability is the function bson_new_from_buffer of the component BSON Parsing. Such manipulation of the argument length leads to integer underflow. This vulnerability is documented as CVE-2026-93395. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in MongoDB C Driver up to 2.3.0 and classified as critical. Affected by this issue is the function bson_new_from_buffer of the component BSON Parsing. The manipulation of the argument length with an unknown input leads to a integer underflow vulnerability. Using CWE to declare the problem leads to CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. Impacted is availability. CVE summarizes:

A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.

The advisory is available at jira.mongodb.org. This vulnerability is handled as CVE-2026-93395 since 09/17/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 2.3.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• C Driver

Version

• 2.0
• 2.1
• 2.2
• 2.3.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion