CVE-2026-106438

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory.

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process.

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection.

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary can cause the application to terminate. The extra byte is not returned through the protocol.

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party controlling name resolution and host responses to write beyond a heap buffer, potentially causing the application to terminate unexpectedly.

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver causes a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed.

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver causes a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed.

The MongoDB C# Driver contains improper neutralization of regular-expression metacharacters in the LINQ query translation component. A caller-supplied character sequence can alter a regular-expression predicate generated by an affected application.