CVE-2026-84965: Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds
Published Sep 3, 2026
·Updated
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.
Affected Software
1 affected component
MongoDB BSON
Event History
Sep 3, 2026
CVE Published
via MITRE·03:01 PM
Data Sourced
via MITRE·03:01 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Are 64-bit deployments in scope?
The issue is described as affecting builds where sizes are 32 bits. The provided information does not establish whether 64-bit builds are affected.
2
What access must an attacker have?
An attacker does not need authentication, but must be able to provide a sufficiently large JSON input to an application that links the affected library.