Description

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-03T15:17:36.250Z",
  "pubdate": "2026-09-03T15:17:36.250Z",
  "executiveSummary": "A critical memory safety vulnerability exists in the MongoDB C Driver within the BSON-to-JSON conversion helper functions.\nThe vulnerability is classified as an out-of-bounds heap write, occurring during the serialization of binary fields when an output length limit is enforced by the caller.\nSuccessful exploitation allows an unauthenticated, remote attacker to perform a localized heap corruption by supplying a specially crafted BSON document.\nThe impact includes potential memory corruption, which may lead to application crashes or unpredictable behavior depending on the heap layout.\nThis vulnerability does not require authentication or elevated privileges, as it can be triggered by providing malicious document content processed by an application using the driver.\nRisk is significant for applications that process untrusted BSON data, as the heap corruption occurs immediately upon processing the malformed document within the conversion routine.",
  "technicalDetails": "The vulnerability resides in the heap management logic of the BSON-to-JSON serialization helpers within the MongoDB C Driver. The flaw is triggered specifically when the serialization process encounters a binary data field and simultaneously hits a caller-defined length constraint for the output buffer.\nThe root cause is an insufficient boundary check during the handling of binary data segments. When the conversion engine attempts to copy bytes from the BSON binary field into the destination JSON string buffer, the length limit logic fails to account for the termination or size adjustment requirements for binary data blobs. Consequently, when the remaining space in the heap buffer is less than the required space to encode the binary field and its metadata, the driver inadvertently writes a small, controlled number of bytes past the allocated heap boundary.\nThe attack flow begins when an application accepts a BSON document from an external source and invokes the BSON-to-JSON helper functions with a defined size limit. An attacker crafts a BSON document containing a binary subtype field specifically designed to force the conversion logic into this edge case. As the driver processes the BSON field, the logic error causes the pointer tracking the current heap offset to exceed the buffer's capacity.\nBecause the overflow occurs on the heap, the attacker can influence the corruption of adjacent heap metadata or adjacent data objects. While the number of bytes overwritten is small, this is sufficient to potentially overwrite object pointers, flag structures, or length headers of subsequent heap allocations. Such corruption typically leads to process instability or, in specific heap grooming scenarios, could be leveraged to gain arbitrary code execution or to bypass application-level security checks.\nThe vulnerability is inherent to the logic of the C-based driver and does not depend on the operating system or specific architecture, though the impact of heap corruption is highly dependent on the heap implementation provided by the underlying C library (e.g., glibc malloc).\nNo authentication or specific privileges are required to reach the vulnerable code, provided the target application processes user-supplied BSON documents through the affected conversion helpers. The primary requirement for exploitation is the ability to submit a BSON document that the target system will attempt to convert to JSON under the specified length constraints."
}