CVE-2026-93393: Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not establishedNothing in the sources we check

DescriptionNVD

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Out-of-bounds Write · Memory Corruption

Vendor

MongoDB Inc.

Published

September 2026

Band

Unlikely (under 1%), September 2026

• NVD entrynvd.nist.gov
• Vendor advisoryjira.mongodb.org
• CVE recordcve.org
• Weakness CWE-787cwe.mitre.org