CVE-2026-84970
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.2
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.10%
- CWE
- CWE-681
- Published
- 2026-09-03
- Last modified
- 2026-09-03
Affected products
- MongoDB C++ Driver
Weakness type
Related vulnerabilities
- CVE-2026-69438 — Microsoft JScript Remote Code Execution Vulnerability
- CVE-2026-84963 — Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
- CVE-2026-84966 — BSON element injection via NUL-embedded document keys in builder append
- CVE-2026-82522 — libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
- CVE-2026-82457 — su-exec through 0.3 Privilege Escalation via Numeric User ID
- CVE-2026-75145 — FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer
- CVE-2026-19879 — Io.undertow/undertow: undertow: http response header integrity issue due to character truncation
- CVE-2026-6426 — Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access