CVE-2026-967468.3HighCWE-787
CVE-2026-96746: Heap buffer overflow via mid-scan command list growth in client topology monitoring
MongoDB · C Driver
Vendor fix available · Affected: MongoDB C Driver · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.4%probability of exploitation in the next 30 days
34th percentile
050100
Higher than 34% of scored CVEs
8.3HighCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 25 Sep.
- MongoDB Fixes Seven Driver Flaws, Including Rogue Server AttacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.