CVE-2026-106431CWE-787

CVE-2026-106431

Medium · published October 8, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
5.9 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
0.00097 · 0.7th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-10-08T23:16Z
References (1)
https://jira.mongodb.org/browse/CDRIVER-6418 · [email protected]
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 08 OCT 18:40Z
    One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
    cvelistv5
  • 08 OCT 18:40Z
    One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
    cvelistv5