CVE-2026-106437

Name of the Vulnerable Software and Affected Versions MongoDB C Driver (affected versions not specified)

Description The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. This allows subsequent append or comparison operations to underflow unsigned length calculations, leading to reads or writes outside the document buffer. An actor capable of influencing the length supplied by an embedding application can cause the application to terminate or result in the reading or corruption of adjacent process memory. This occurs when an application passes an undersized value to the bson reserve buffer() function and subsequently performs an affected operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.