---
id: CVE-2026-84969
title: >-
  A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB
  C Driver can write a small number of bytes past the end of a heap buffer when
  a binary field is encoded and the output is cut short at a caller-configured
  leng…
summary: >-
  A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB
  C Driver can write a small number of bytes past the end of a heap buffer when
  a binary field is encoded and the output is cut short at a caller-configured
  leng…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-787
vendor: mongodb
product: c_driver
affected:
  - 'c_driver >= 1.30.0, < 1.30.9'
  - 'c_driver >= 2.0.0, < 2.5.2'
patched:
  - c_driver 2.5.2
published: '2026-09-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T19:50:25.773'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84969'
references:
  - url: 'https://jira.mongodb.org/browse/CDRIVER-6410'
    label: cna@mongodb.com
tags:
  - nvd
epss: 0.00271
epssPercentile: 0.17257
ingestedAt: '2026-09-10T20:04:29.977Z'
---

## Overview

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

## Affected

- `c_driver >= 1.30.0, < 1.30.9`
- `c_driver >= 2.0.0, < 2.5.2`

## Remediation

Upgrade past the affected range:

- `c_driver 2.5.2`