CVE-2026-93393: Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to, or an attacker able to impersonate or redirect the client's connection, can cause the driver to write attacker-supplied data outside the bounds of a heap allocation while processing incoming encrypted traffic. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Successful exploitation may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the MongoDB C Driver built with the Windows platform TLS backend are exposed when they connect to a remote endpoint that can send the malicious encrypted TLS traffic. The issue affects the client process rather than requiring compromise of the MongoDB server.
What access does an attacker need to exploit this?
An attacker needs to control the remote endpoint the client connects to, or be able to impersonate or redirect that connection. No authentication credentials or user interaction are required because the vulnerable processing happens before application-level authentication.
What can be done if patching is not immediately possible?
Limit connections to trusted, expected remote endpoints and prevent attackers from redirecting or impersonating those connections. This reduces exposure to malicious TLS peers, although the provided information does not identify a complete workaround.
How might exploitation affect an application?
Successful exploitation may corrupt memory in the client process, disclose adjacent heap memory, or terminate the process. The vulnerability is a heap-based buffer overflow while processing incoming encrypted TLS traffic.