Executive brief
The MongoDB C Driver contains a memory-handling flaw in its BSON-to-JSON conversion code that can write data beyond the intended buffer boundary when processing binary fields with output length limits. An attacker who can supply document content to an application using this driver can cause a small amount of adjacent memory to be corrupted, potentially leading to application instability or information disclosure.
Technical details
A buffer overflow vulnerability exists in the BSON-to-JSON conversion helpers of the MongoDB C Driver when encoding binary fields that are truncated at a caller-configured length limit. The vulnerability occurs during base64 encoding of binary data; the code fails to properly check boundaries when truncating the output, causing a small number of bytes to be written past the end of the heap buffer. An attacker with no privileges on the application can exploit this by supplying a specially crafted BSON document containing a binary field. The issue affects versions prior to 2.5.2 and 1.30.9, and patches are now available in those versions.
Affected products
- MongoDB C Driver before 1.30.9 and before 2.5.2
Timeline
- 2026-09-03: disclosed
- 2026-09-04: patched: Fixed in versions 1.30.9 and 2.5.2