CVE-2026-84969 — Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output

CVE-2026-84969

Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output PUBLISHED

Description (CNA)

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

Affected (CNA)

Vendor / product	Versions
MongoDB / C Driver	affected 1.30.0 before 1.30.9; affected 2.0.0 before 2.5.2

CWE

CWE-787

References

https://jira.mongodb.org/browse/CDRIVER-6410

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.