CVE-2026-106431 One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
An off-by-one error in the MongoDB C Driver allows heap corruption or crashes when specific document sizes are serialized via the bulk-writer API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106431?
CVE-2026-106431 is a medium-severity memory corruption vulnerability in MongoDB C Driver, published on 8 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.
Weakness: CWE-787
Which versions are affected by CVE-2026-106431?
How do I fix CVE-2026-106431?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-106431 being exploited?
There is no known exploitation of CVE-2026-106431 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-106431, UBUNTU-CVE-2026-106431.