CVE-2026-84965: CWE-190: Integer Overflow or Wraparound in MongoDB C Driver

This vulnerability involves an integer wraparound in the BSON library's JSON parsing code within the MongoDB C Driver. Specifically, the allocation size calculation can overflow, leading to a buffer being released prematurely while a following copy operation still writes through the stale pointer. This can cause an application crash (denial of service) when processing large JSON inputs on builds where sizes are 32 bits. The vulnerability affects versions >=1.10.0 <1.30.9 and >=2.0.0 <2.5.2.

An unauthenticated attacker able to provide a sufficiently large JSON input to an application linking the vulnerable MongoDB C Driver library can cause the application to terminate unexpectedly. This results in a denial of service condition. There is no indication of code execution or data corruption beyond the crash. The CVSS 4.0 base score is 5.9 (medium severity), reflecting local attack vector with high attack complexity and partial impact on availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should consider limiting JSON input size or applying other input validation controls to mitigate potential denial of service.