CVE-2026-106437— Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver
Quick assessment
Affected
MongoDB C Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB C 驱动中的 BSON 缓冲区预留 API（bson_reserve_buffer）可能记录小于五字节（BSON 最小长度）的长度值。后续的附加或比较操作可能导致无符号长度计算发生下溢，从而引发对文档缓冲区之外的内存进行读取或写入。攻击者若能控制嵌入应用程序所传入的长度值，可导致应用程序终止，或读取、破坏相邻的进程内存。要触发此漏洞，应用程序需先向 bson_reserve_buffer 传递一个过小的长度值，随后执行受影响的操作。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106437
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver
Source: CVE Program / CVE List V5
Vulnerability Description
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-106437
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106437
请登录查看更多情报信息。
Other References for CVE-2026-106437 (1)
Same Patch Batch · MongoDB · 2026-10-08 · 13 CVEs total
| CVE-2026-106433 | 8.8 HIGH | Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt |
| CVE-2026-106429 | 6.5 MEDIUM | Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt |
| CVE-2026-106430 | 5.9 MEDIUM | Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver |
| CVE-2026-107325 | 5.9 MEDIUM | Application denial of service via missing BSON array length validation in MongoDB Go Drive |
| CVE-2026-107324 | 5.9 MEDIUM | Application denial of service via integer overflow in BSON value-length validation in Mong |
| CVE-2026-106431 | 5.7 MEDIUM | One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver |
| CVE-2026-106435 | 5.1 MEDIUM | Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Pyt |
| CVE-2026-106436 | 4.8 MEDIUM | Application denial of service and data truncation via unchecked BSON append failures in Mo |
| CVE-2026-106434 | 4.3 MEDIUM | Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt |
| CVE-2026-106438 | 4.0 MEDIUM | Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver |
| CVE-2026-106428 | 3.7 LOW | Out-of-bounds read in SCRAM response parsing in MongoDB C Driver |
| CVE-2026-106432 | 3.6 LOW | Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver |
IV. Related Vulnerabilities
Same product: C Driver
-
CVE-2026-106438
Silent Decimal128 value corruption via incorrect exactness c -
CVE-2026-106431
One-byte heap buffer overflow in BSON bulk document writer i -
CVE-2026-106428
Out-of-bounds read in SCRAM response parsing in MongoDB C Dr -
CVE-2026-96746
Heap buffer overflow via mid-scan command list growth in cli -
CVE-2026-93395
Integer Underflow → Heap Out-of-Bounds Read in `bson_new_fro
Same vendor: MongoDB
-
CVE-2026-87109
Ops Manager Sensitive MFA Enrollment Information Exposure in -
CVE-2026-87108
Ops Manager Improper Authorization in Daily Host Monitoring -
CVE-2026-87110
Ops Manager Uncontrolled Resource Consumption in Monitoring -
CVE-2026-106435
Application denial of service via out-of-bounds read in BSON -
CVE-2026-106436
Application denial of service and data truncation via unchec
Same weakness: CWE-191
-
CVE-2026-106429
Application denial of service via malformed KMS endpoint in -
CVE-2026-107635
Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK -
CVE-2026-107614
Integer underflow in TightVNC Server cursor shape trimming l -
CVE-2026-19186
Integer underflow in IEEE 802.15.4 frame decryption leads to -
CVE-2026-83742
wstrncat() unsigned integer underflow leads to an off-by-one
V. Comments for CVE-2026-106437
No comments yet