{"id":"CVE-2026-84965","title":"An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer","summary":"An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits,…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-190"],"vendor":"mongodb","product":"c_driver","affected":["c_driver >= 1.10.0, < 1.30.9","c_driver >= 2.0.0, < 2.5.2"],"patched":["c_driver 2.5.2"],"published":"2026-09-03","updated":"2026-09-22","sourceUpdated":"2026-09-22T16:00:19.730","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84965","references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-6405","label":"cna@mongodb.com"}],"tags":["nvd"],"epss":0.00096,"epssPercentile":0.00804,"ingestedAt":"2026-09-22T16:06:00.459Z","slug":"CVE-2026-84965","body":"## Overview\n\nAn integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.\n\n## Affected\n\n- `c_driver >= 1.10.0, < 1.30.9`\n- `c_driver >= 2.0.0, < 2.5.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `c_driver 2.5.2`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}