CVE-2026-84966: BSON element injection via NUL-embedded document keys in builder append
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
The issue is rated local and affects applications that use the BSON document-building component and can be made to pass an extremely large, non-terminated field name in the required form. Authentication is not required for the triggering condition.
Does this vulnerability affect confidentiality or document integrity?
The provided vector indicates no confidentiality or integrity impact. Its stated impact is process termination, with high availability impact.