CVE-2026-84969: CWE-787: Out-of-bounds Write in MongoDB C Driver

This vulnerability (CWE-787) arises from a memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver. Specifically, when a binary field is encoded and the output is truncated at a length limit set by the caller, a small number of bytes can be written past the end of the allocated heap buffer. This out-of-bounds write can be triggered by an attacker who supplies the document content, even without privileges on the application using the driver. The flaw affects MongoDB C Driver versions >=1.30.0 <1.30.9 and >=2.0.0 <2.5.2.

An attacker who can supply document content to an application using the vulnerable MongoDB C Driver versions may cause a small amount of memory outside the intended buffer to be overwritten. This could potentially lead to data corruption or undefined behavior in the application. No privilege is required on the application, but the attacker must be able to supply BSON documents to the driver. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, applications should consider restricting untrusted input that reaches the BSON-to-JSON conversion routines or apply other protective measures as advised by MongoDB once the advisory is published.