CVE-2026-84969: Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to supply document content that the application converts from BSON to JSON. The application must use the driver's BSON-to-JSON conversion helpers with a caller-configured output length limit that cuts the output short while encoding a binary field.
Is authentication required to trigger the issue?
No. The reported attack scenario requires no privileges on the application linking the driver, but the attacker still needs a way to provide the document content processed by that application.
What is the expected impact?
The issue can alter a small number of bytes beyond the intended heap buffer. The provided impact assessment indicates integrity impact only, with no reported confidentiality or availability impact.