CVE-2026-93393 describes a heap-based buffer overflow in the TLS transport layer of the MongoDB C Driver specifically when built with the Windows platform TLS backend. The vulnerability is triggered by processing incoming encrypted traffic from a remote endpoint or an attacker who can impersonate or redirect the connection. Because the flaw occurs before application-level authentication, no credentials or user interaction are needed to exploit it. Successful exploitation can lead to memory corruption, potential disclosure of adjacent heap memory, or crash of the client process.

The vulnerability allows an unauthenticated remote attacker who can control or redirect the TLS connection to cause memory corruption in the MongoDB C Driver client process. This can lead to disclosure of sensitive memory contents adjacent to the heap allocation or cause the client process to terminate unexpectedly, impacting confidentiality, integrity, and availability of the client application.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting the MongoDB C Driver built with the Windows TLS backend to untrusted or potentially malicious endpoints.