CVE-2026-84966: CWE-681: Incorrect Conversion between Numeric Types in MongoDB C++ Driver
Description
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.
CVSS v4.0
Score 5.9medium
Affected software
MongoDB
C++ Driver
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from an incorrect conversion between numeric types in the BSON document building component of the MongoDB C++ Driver (version 3.2.0). When an application provides an extremely large, non-terminated field name, the driver may misinterpret the length value, causing it to read beyond the intended memory buffer. This can result in the termination of the calling process. Exploitation does not require authentication but depends on the application passing the oversized field name in a particular form. The vulnerability is tracked as CWE-681 (Incorrect Conversion between Numeric Types).
Potential Impact
Successful exploitation can cause the calling process to terminate unexpectedly due to out-of-bounds memory reads. This may lead to denial of service conditions in applications using the affected MongoDB C++ Driver version 3.2.0. There is no indication of code execution or data corruption beyond process termination.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, applications should avoid passing extremely large, non-terminated field names to the BSON document builder in the MongoDB C++ Driver version 3.2.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-09-02T17:58:52.742Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9990d3acd9273b491c2218
Added to database: 09/03/2026, 15:22:59 UTC
Last enriched: 09/07/2026, 13:04:44 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.