CVE-2026-96746— Heap buffer overflow via mid-scan command list growth in client topology monitoring
Quick assessment
Affected
MongoDB C Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB C 驱动程序的连接监控逻辑中存在缓冲区越界写入漏洞，攻击者若能控制域名解析过程，并能提供客户端连接字符串中所指定主机名的响应数据，则可能向堆缓冲区的末尾之外写入数据。这可能导致使用该驱动程序的应用程序意外终止。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96746
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Heap buffer overflow via mid-scan command list growth in client topology monitoring
Source: CVE Program / CVE List V5
Vulnerability Description
An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-96746
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96746
请登录查看更多情报信息。
Other References for CVE-2026-96746 (3)
Same Patch Batch · MongoDB · 2026-09-24 · 7 CVEs total
| CVE-2026-96749 | 8.4 HIGH | Heap out-of-bounds write via signed size overflow in BSON document encoding |
| CVE-2026-96750 | 7.1 HIGH | Shell script injection via server-supplied database name in Open MongoDB shell |
| CVE-2026-96744 | 7.1 HIGH | Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB |
| CVE-2026-96748 | 6.5 MEDIUM | Connection redirection via percent-encoded delimiter injection in connection string hosts |
| CVE-2026-96745 | 5.6 MEDIUM | PHP object injection via unsuppressible __pclass class inference in command monitoring eve |
| CVE-2026-96747 | 5.0 MEDIUM | Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encrypt |
IV. Related Vulnerabilities
Same product: C Driver
-
CVE-2026-93395
Integer Underflow → Heap Out-of-Bounds Read in `bson_new_fro -
CVE-2026-93394
libmongoc SCRAM client nonce-validation bypass -
CVE-2026-93393
Heap overflow via oversized decrypted TLS record sequence in -
CVE-2026-88036
GridFS data disclosure and deletion via query-operator injec -
CVE-2026-88035
Heap buffer overflow via wrapped size check during SASL user
Same vendor: MongoDB
-
CVE-2026-96749
Heap out-of-bounds write via signed size overflow in BSON do -
CVE-2026-96748
Connection redirection via percent-encoded delimiter injecti -
CVE-2026-96747
Forced local Unix socket connection via dot-sock KMS endpoin -
CVE-2026-96745
PHP object injection via unsuppressible __pclass class infer -
CVE-2026-96750
Shell script injection via server-supplied database name in
Same weakness: CWE-787
-
CVE-2026-100888
Trusted Domain Project OpenDKIM DKIM Signature Header Select -
CVE-2026-100740
D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_par -
CVE-2026-100504
Ghidra through 12.1.4 Stack-based Buffer Overflow via leftsh -
CVE-2026-80431
Out-of-bounds write in the kitty text sizing protocol allows -
CVE-2026-87118
Botslab G980H Dashcams Out-of-bounds Write
V. Comments for CVE-2026-96746
No comments yet