MongoDB C Driver up to 1.30.12/2.5.5 BSON buffer-reservation API bson_reserve_buffer integer underflow

Summaryinfo

A vulnerability described as very critical has been identified in MongoDB C Driver up to 1.30.12/2.5.5. The impacted element is the function bson_reserve_buffer of the component BSON buffer-reservation API. Such manipulation leads to integer underflow. This vulnerability is uniquely identified as CVE-2026-106437. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in MongoDB C Driver up to 1.30.12/2.5.5. Affected by this issue is the function bson_reserve_buffer of the component BSON buffer-reservation API. The manipulation with an unknown input leads to a integer underflow vulnerability. Using CWE to declare the problem leads to CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.

The advisory is shared for download at jira.mongodb.org. This vulnerability is handled as CVE-2026-106437 since 10/06/2026. The exploitation is known to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/08/2026).

Upgrading to version 1.30.13 or 2.5.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• C Driver

Version

• 1.30.0
• 1.30.1
• 1.30.2
• 1.30.3
• 1.30.4
• 1.30.5
• 1.30.6
• 1.30.7
• 1.30.8
• 1.30.9
• 1.30.10
• 1.30.11
• 1.30.12
• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion