CVE-2026-93395 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()

What is CVE-2026-93395?

CVE-2026-93395 is a medium-severity vulnerability in MongoDB Inc. C Driver, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.

Weakness: CWE-191

Which versions are affected by CVE-2026-93395?

It affects 1 product.

Products include Mongodb C Driver.

How do I fix CVE-2026-93395?

Apply the vendor's patch.

Is CVE-2026-93395 being exploited?

There is no known exploitation of CVE-2026-93395 in the wild and no public exploit code.

Other vulnerabilities in MongoDB Inc. C Driver

• CVE-2026-93393 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream Critical 9.2
• CVE-2026-6691 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow High 8.6
• CVE-2026-84964 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client High 8.2
• CVE-2024-7553 Accessing Untrusted Directory May Allow Local Privilege Escalation High 7.3
• CVE-2025-12119 Bulk write with options may read invalid memory Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-93395, GHSA-jm9m-v7jc-m4j8, UBUNTU-CVE-2026-93395.