CVE-2026-84964: CWE-415: Double Free in MongoDB C Driver

CVE-2026-84964 is a double free vulnerability classified under CWE-415 in the MongoDB C Driver's TLS certificate revocation checking mechanism that uses OpenSSL. The flaw arises during the TLS handshake when maliciously crafted certificate data causes the same heap memory object to be freed twice, leading to potential application crashes. This vulnerability affects MongoDB C Driver versions >=1.17.0 and <1.30.9, as well as >=2.0.0 and <2.5.2. The vulnerability can be exploited remotely by an unauthenticated attacker who can act as a trusted TLS endpoint. The CVSS 4.0 base score is 8.2, indicating high severity, with network attack vector, high attack complexity, no privileges or user interaction required, and high impact on availability.

Successful exploitation of this vulnerability can cause unexpected termination of the client application using the MongoDB C Driver, potentially leading to denial of service. There is no indication of code execution or data compromise from the provided data. The attacker must be able to act as a trusted TLS endpoint to trigger the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider mitigating exposure by restricting connections to trusted TLS endpoints and monitoring for abnormal client application terminations related to TLS handshakes. No vendor advisory or patch links were provided in the input data.