A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without
    adequate validation. Crafted documents in a GridFS collection may cause any application that reads those
    files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents
    (via an out-of-bounds read). (CVE-2026-9100)

  - A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response
    and cause a crash in applications using the MongoDB C driver. (CVE-2026-4359)

  - A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name
    components to pass without sanitization when the driver composes the target namespace for an operation. An
    application that incorporates untrusted input into these name components can have operations directed at a
    resource other than the one intended. (CVE-2026-81524)

  - An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may
    cause an unusually large text value to be silently shortened, or the corresponding field to be omitted,
    while the parsing operation still reports success and returns no error. An unauthenticated party who can
    supply the input processed by an application that uses this component may cause that application to hold
    data that does not match what was submitted, which may result in unintended alteration of data.
    (CVE-2026-84963)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the     Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write     uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic     after the TLS handshake completes. No authentication or user interaction is required, because the affected     processing occurs before any application-level authentication completes. Triggering this issue may lead to     memory corruption in the client process, disclosure of adjacent heap memory, or termination of the     process. (CVE-2026-93393)

  - A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the     Windows platform TLS backend. A remote endpoint that the client connects to, or an attacker able to     impersonate or redirect the client's connection, can cause the driver to write attacker-supplied data     outside the bounds of a heap allocation while processing incoming encrypted traffic. No authentication or     user interaction is required, because the affected processing occurs before any application-level     authentication completes. Successful exploitation may lead to memory corruption in the client process,     disclosure of adjacent heap memory, or termination of the process. (CVE-2026-93393)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477562	Alpine: mongo-c-driver: security update to 1.30.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
477562	Alpine: mongo-c-driver: security update to 1.30.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
348131	Linux Distros Unpatched Vulnerability : CVE-2026-93393	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-93393

critical

Tenable Plugins

critical

critical

critical