CVE-2026-96746

6.5 MEDIUMpublic exploit available

Published 2026-09-24 · Updated 2026-09-24

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses

CWE-787

Public exploit & PoC references

https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.12
https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.5
https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4v46

All references

https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.12
https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.5
https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4v46

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-10027
HIGHCVE-2026-100504PoC
CRITICALCVE-2026-100740
HIGHCVE-2026-100888
MEDIUMCVE-2026-101202
MEDIUMCVE-2026-101203
HIGHCVE-2026-102004
HIGHCVE-2026-102301

Related by shared AI tags and CWE weakness class. Browse the full archive.