Description

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.1",
  "pubDate": "2026-09-03T16:18:25.563Z",
  "pubdate": "2026-09-03T16:18:25.563Z",
  "executiveSummary": "The MongoDB C++ Driver is susceptible to an out-of-bounds memory read vulnerability originating from incorrect numeric type conversion within its BSON document construction logic. This flaw allows an attacker to cause an application process to crash by providing a maliciously crafted, oversized, and non-terminated field name. The vulnerability affects the BSON builder component, which fails to correctly sanitize or length-validate user-supplied field identifiers before processing. This issue represents a significant stability risk for applications utilizing the driver, as it facilitates a remote denial-of-service (DoS) condition. Exploitation does not require prior authentication or elevated privileges, provided the application accepts user-controlled input that is subsequently passed to the BSON builder. Because the library reads memory outside of the intended buffer bounds, the resulting instability typically leads to immediate process termination. Organizations relying on the MongoDB C++ Driver for data ingestion or document generation should prioritize validating the integrity and length of all input field names before they are passed to the builder to mitigate the risk of service disruption.",
  "technicalDetails": "The vulnerability resides within the BSON document building component of the MongoDB C++ Driver. The root cause is an incorrect numeric type conversion when the driver calculates the length of field names provided during document construction. Specifically, when an application passes a field name of an extremely large size, the internal type conversion logic fails to correctly represent or validate the length, leading to a buffer handling discrepancy.\nThe attack flow begins when an attacker supplies a non-terminated string of excessive length as a field name to the BSON builder interface. Because the driver performs internal operations based on the inaccurately converted numeric length, the component proceeds to read memory beyond the allocated stack or heap buffer associated with that field name. This out-of-bounds read occurs because the builder assumes the presence of a null-terminator or a specific length constraint that the supplied input violates.\nAs the library attempts to process the field name based on the corrupted length value, it traverses memory addresses residing outside of its intended bounds. Depending on the memory layout and the protection mechanisms of the underlying operating system, this results in an invalid memory access attempt. The immediate outcome is the termination of the calling process, effectively triggering a denial-of-service. The attack is particularly dangerous because it does not require authentication or specific authorization levels; the sole requirement is that the application interface must pass the improperly formed input to the BSON builder component. No specific memory corruption or code execution vector is required to achieve the crash, as the process memory access violation itself serves as the exploit primitive.\nBecause the defect exists in the fundamental logic of the BSON builder, the vulnerability is highly deterministic. Any application using the affected MongoDB C++ Driver version that performs BSON serialization on untrusted input is exposed. The impact is limited to the exhaustion of availability; however, in high-throughput database environments, this could lead to significant operational downtime. There is no evidence currently that this memory corruption can be leveraged for arbitrary code execution, but the deterministic nature of the process termination makes it an reliable target for service interruption attacks."
}