CVE-2026-106431

Name of the Vulnerable Software and Affected Versions MongoDB C Driver (affected versions not specified)

Description An off-by-one error exists in the BSON bulk document writer. This occurs when a document ends at a specific buffer boundary, causing the writer to write one zero byte immediately past a heap allocation. An attacker capable of influencing the size of documents serialized by an embedding application can corrupt adjacent process memory or cause the process to terminate. This issue is triggered when the application utilizes the BSON bulk-writer API and produces a precise cumulative document size.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.