CVE-2026-93393

Katalog CVE

CVSS 8.1 · High EPSS 0,47%

Kerentanan Out-of-bounds Write pada mongodb c driver. Skor CVSS 3.1 8.1 (High) menurut mongodb.com.

Deskripsi (NVD)

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.

Rincian

Terbit di NVD

17 September 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber mongodb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/CDRIVER-6417 advisory vendor