CVE-2026-93395— Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
Quick assessment
Affected
MongoDB Inc. C Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libbson 中的 函数存在下限验证缺失漏洞。在处理带有零长度前缀的 BSON 数据时，该漏洞会导致整数下溢。具体而言，该函数会从输入缓冲区中读取一个 32 位的文档长度值，但在将其用于数组索引计算之前，未验证该值是否至少为 5（BSON 文档的最小有效大小）。当长度字段为 0 时，用于检查文档空终止符的表达式会回绕为 ，从而导致堆越界读取并引发进程崩溃。能够向使用此 API 的应用程序提供特制 BSON 输入的攻击者可利用此漏洞造成服务拒绝（DoS）。
Possible ATT&CK Techniques 2 AI
T1499 · Endpoint Denial of Service T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB Inc. | C Driver | 2.0.0< 2.3.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93395
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
Source: CVE Program / CVE List V5
Vulnerability Description
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB Inc. | C Driver | 2.0.0 ~ 2.3.1 | - |
|
II. Public POCs for CVE-2026-93395
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93395
请登录查看更多情报信息。
Vendor Pages for CVE-2026-93395 (1)
Same Patch Batch · MongoDB Inc. · 2026-09-17 · 6 CVEs total
| CVE-2026-93393 | 8.1 HIGH | Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream |
| CVE-2026-92756 | 5.5 MEDIUM | Combining encryption settings may disable encryption |
| CVE-2026-92757 | 5.5 MEDIUM | Malformed connection string may disable field level encryption |
| CVE-2026-92758 | 5.5 MEDIUM | Logs may collect sensitive information |
| CVE-2026-93394 | 3.7 LOW | libmongoc SCRAM client nonce-validation bypass |
IV. Related Vulnerabilities
Same product: C Driver
-
CVE-2026-93394
libmongoc SCRAM client nonce-validation bypass -
CVE-2026-93393
Heap overflow via oversized decrypted TLS record sequence in -
CVE-2026-88036
GridFS data disclosure and deletion via query-operator injec -
CVE-2026-88035
Heap buffer overflow via wrapped size check during SASL user -
CVE-2026-84963
Silent field truncation via unchecked int cast of huge JSON
Same vendor: MongoDB Inc.
-
CVE-2026-93759
Server-side JavaScript injection via string query criteria b -
CVE-2026-93760
NoSQL injection of JavaScript-executing query operators via -
CVE-2026-93761
Denial of service via unbounded regex matching in Mongoid's -
CVE-2026-93762
Data deletion and attribute disclosure via field-name method -
CVE-2026-93763
Silent plaintext persistence via unresolved callable databas
Same weakness: CWE-191
-
CVE-2026-61720
FluidSynth: SF2 DMOD Chunk Unsigned Underflow -
CVE-2026-93599
rustls-webpki before 0.103.13 Panic via empty BIT STRING -
CVE-2026-91103
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vul -
CVE-2026-91948
FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL -
CVE-2026-90996
Sssd: sssd: denial of service in nss responder via crafted z
V. Comments for CVE-2026-93395
No comments yet