CVE-2026-84965: Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/mongo-c-driverto a version that resolves this vulnerability.Fixed in 1.30.14-r0
Event History
Frequently Asked Questions
Are 64-bit deployments in scope?
The issue is described as affecting builds where sizes are 32 bits. The provided information does not establish whether 64-bit builds are affected.
What access must an attacker have?
An attacker does not need authentication, but must be able to provide a sufficiently large JSON input to an application that links the affected library.