CVE-2026-93395

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93395

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93395.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93395

Downstream

Published

2026-09-17T20:34:57Z

Modified

2026-09-27T03:47:38Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()

Details

A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.

Database specific

{
    "cna_assigner":  "mongodb",
    "cwe_ids":  [
        "CWE-191"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93395.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "fixed":  "2.3.1"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/mongodb/mongo-c-driver

Affected ranges

Type

GIT

Repo

https://github.com/mongodb/mongo-c-driver

Events

Introduced

67817df0a9ed11b07e457477e6db1384da9421c4

Fixed

e44471f5dbc74e4c2ac9090a633e55491dfc1fa4

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*",
    "extracted_events":  [
        {
            "introduced":  "2.0.0"
        },
        {
            "fixed":  "2.3.1"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93395.json"