Mongodb C Driver vulnerabilities

• mongodb atlas sql odbc driver MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write CVE-2026-120952 6.0 MediumNovember 3, 2026
• mongodb atlas sql jdbc driver Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler CVE-2026-120953 5.1 MediumNovember 3, 2026
• mongodb c driver Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views CVE-2026-120954 Fix available 6.3 MediumNovember 3, 2026
• mongodb c driver MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata CVE-2026-120955 Fix available 8.7 HighNovember 3, 2026
• mongodb c driver remote abort and memory disclosure from a malformed cursor.ns CVE-2026-120956 Fix available 7.1 HighNovember 3, 2026
• mongodb c driver MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password CVE-2026-120684 Fix available 6.0 MediumNovember 3, 2026
• mongodb c driver MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service) CVE-2026-120678 Fix available 8.7 HighNovember 3, 2026
• mongodb c driver Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping CVE-2026-114645 Fix available 5.7 MediumOctober 22, 2026
• mongodb c driver Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver CVE-2026-106438 Fix available 5.1 MediumOctober 8, 2026
• mongodb c driver Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver CVE-2026-106437 Fix available 5.9 MediumOctober 8, 2026
• mongodb c driver One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver CVE-2026-106431 Fix available 5.9 MediumOctober 8, 2026
• mongodb c driver Out-of-bounds read in SCRAM response parsing in MongoDB C Driver CVE-2026-106428 Fix available 6.3 MediumOctober 8, 2026
• mongodb c driver Heap buffer overflow via mid-scan command list growth in client topology monitoring CVE-2026-96746 Fix available 8.3 HighSeptember 24, 2026
• mongodb c driver GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver CVE-2026-88036 Fix available 6.1 MediumSeptember 10, 2026
• mongodb c driver Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver CVE-2026-88035 Fix available 5.7 MediumSeptember 10, 2026
• mongodb c driver Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser CVE-2026-84963 Fix available 6.3 MediumSeptember 3, 2026
• mongodb c driver Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client CVE-2026-84964 Fix available 8.2 HighSeptember 3, 2026
• mongodb c driver Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds CVE-2026-84965 Fix available 5.9 MediumSeptember 3, 2026
• mongodb c driver Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output CVE-2026-84969 Fix available 6.3 MediumSeptember 3, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values CVE-2026-81533 6.0 MediumAugust 28, 2026
• mongodb bi connector odbc driver BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption CVE-2026-81532 8.7 HighAugust 28, 2026
• mongodb c driver Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver CVE-2026-81524 Fix available 5.3 MediumAugust 27, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings CVE-2026-19003 8.4 HighAugust 12, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters CVE-2026-19004 8.8 HighAugust 12, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data CVE-2026-18888 7.1 HighAugust 12, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names CVE-2026-19001 9.5 CriticalAugust 12, 2026
• mongodb bi connector odbc driver Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver CVE-2026-19002 8.8 HighAugust 12, 2026
• mongodb atlas sql odbc driver, odbc driver, schema builder cli +1 more +3 more Insufficient OIDC endpoint validation could invoke unintended local protocol handlers CVE-2026-19503 6.3 MediumAugust 12, 2026
• mongodb c driver, php driver +1 more Bulk write with options may read invalid memory CVE-2025-12119 Fix available 6.9 MediumNovember 18, 2025
• mongodb bi connector odbc driver MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories CVE-2025-12100 8.8 HighOctober 23, 2025
• mongodb atlas sql odbc driver MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories CVE-2025-11575 8.8 HighOctober 23, 2025