---
id: CVE-2026-93393
title: >-
  A heap-based buffer overflow exists in the TLS transport layer of the MongoDB
  C Driver when built with the Windows platform TLS backend
summary: >-
  A heap-based buffer overflow exists in the TLS transport layer of the MongoDB
  C Driver when built with the Windows platform TLS backend. A remote endpoint
  that the client connects to can cause the driver to write uncontrolled data
  outsid…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: MongoDB Inc.
product: C Driver
affected:
  - c_driver 2.4.0
  - c_driver >= 2.3.0 <= 2.3.3
  - c_driver >= 2.2.0 <= 2.2.4
  - c_driver >= 2.1.0 <= 2.1.2
  - c_driver >= 2.0.0 <= 2.0.2
  - c_driver >= 1.30.0 <= 1.30.8
  - c_driver >= 1.29.0 <= 1.29.2
  - c_driver >= 1.28.0 <= 1.28.1
  - c_driver >= 1.27.0 <= 1.27.6
  - c_driver >= 1.26.0 <= 1.26.2
  - c_driver >= 1.25.0 <= 1.25.4
  - c_driver >= 1.24.0 <= 1.24.4
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:05:01.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93393'
references:
  - url: 'https://jira.mongodb.org/browse/CDRIVER-6417'
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
epss: 0.00468
epssPercentile: 0.37792
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T17:33:19.062224Z'
ingestedAt: '2026-09-17T21:29:16.991Z'
---

## Overview

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.