Signals
Back to database
Soon59Medium5.9VulnerabilityCVE-2026-106435No patch link observed

CVE-2026-106435 — The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-…

Published Oct 8, 2026, 09:17 PM UTCIngested 2h agoSource NVD(cve-db)CVE-2026-106435

Description

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.

CVSS v4.0 base metrics

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
5.9

Medium severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Local

Attack Vector

AC

Low

Attack Complexity

AT

Present

Attack Requirements

PR

None

Privileges Required

UI

None

User Interaction

VC

None

Confidentiality (Vulnerable System)

VI

None

Integrity (Vulnerable System)

VA

High

Availability (Vulnerable System)

SC

None

Confidentiality (Subsequent System)

SI

None

Integrity (Subsequent System)

SA

None

Availability (Subsequent System)

References

Related threats

same CWE or vendor
Medium

CVE-2026-107738 — SumatraPDF is a multi-format reader for Windows.

CVE-2026-107738 · 2h ago

Medium

CVE-2026-107731 — SumatraPDF is a multi-format reader for Windows.

CVE-2026-107731 · 2h ago

Medium

CVE-2026-107729 — SumatraPDF is a multi-format reader for Windows.

CVE-2026-107729 · 2h ago

Low

CVE-2026-12091 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-b…

CVE-2026-12091 · 4h ago

High

CVE-2026-82334 — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser.

CVE-2026-82334 · 5h ago

Medium

CVE-2026-106428 — An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing…

CVE-2026-106428 · 6h ago