8.1Alta
CVE-2026-93393Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream
Descripción
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.
Debilidad (CWE):
CWE-787
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| MongoDB Inc. | C Driver | 2.4.0, 2.3.0 – ≤ 2.3.3, 2.2.0 – ≤ 2.2.4, 2.1.0 – ≤ 2.1.2, 2.0.0 – ≤ 2.0.2, 1.30.0 – ≤ 1.30.8, 1.29.0 – ≤ 1.29.2, 1.28.0 – ≤ 1.28.1, 1.27.0 – ≤ 1.27.6, 1.26.0 – ≤ 1.26.2, 1.25.0 – ≤ 1.25.4, 1.24.0 – ≤ 1.24.4 |
Referencias y parches
- https://jira.mongodb.org/browse/CDRIVER-6417 Vendor Advisory
Coincidencias CPE (NVD) (2)
cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*≥ 1.10.0 < 1.30.11cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*≥ 2.2.0 < 2.5.4