CVE-2026-106431

Name	CVE-2026-106431
Description	An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mongo-c-driver (PTS)	bookworm	1.23.1-1+deb12u3	vulnerable
	trixie	1.30.4-1+deb13u3	vulnerable
	forky	2.5.5-1	vulnerable
	sid	2.5.6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mongo-c-driver	source	(unstable)	2.5.6-1

Notes

[trixie] - mongo-c-driver <no-dsa> (Minor issue)
https://jira.mongodb.org/browse/CDRIVER-6418
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/bddaffdabdb449d8ee5e8b28f9a82afd03cd42aa (2.5.6)
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/70d96b8f28974e02cc966a00953dc3d8c308b8ff (1.30.13)