CVE-2026-84965
Awaiting Analysis Awaiting Analysis - Queue

Integer Wraparound in BSON Library Leads to Denial of Service

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: MongoDB, Inc.

Description
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-15
AI Q&A
2026-09-03
EPSS Evaluated
2026-09-14
NVD
CVE-2026-84965
EUVD
EUVD-2026-70513

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb bson *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an integer wraparound in the BSON library's JSON parsing code. It causes a buffer to be released while a subsequent copy operation still writes through the stale pointer. On systems where sizes are 32 bits, an attacker can supply a large JSON input to crash the application, leading to denial of service.

Detection Guidance

This vulnerability involves an integer wraparound in BSON library's JSON parsing code, leading to a buffer release while a copy operation continues. Detection requires checking if your system uses a 32-bit build of the BSON library and if it processes large JSON inputs. Review application logs for crashes during JSON parsing and verify library versions. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to cause an application using the BSON library to crash unexpectedly. This results in a denial of service, making the application unavailable for users.

Compliance Impact

This vulnerability causes denial of service due to an integer wraparound in allocation size calculation, leading to application termination. It does not directly affect data confidentiality or integrity but may impact availability. Compliance standards like GDPR and HIPAA primarily focus on data protection and availability; thus, this issue could indirectly affect compliance by disrupting services handling sensitive data.

Mitigation Strategies

Update the BSON library to the latest patched version to address the integer wraparound issue in allocation size calculation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84965. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart