Hi,

The following vulnerability was published for mongo-c-driver.

CVE-2026-93393[0]:
| A heap-based buffer overflow exists in the TLS transport layer of
| the MongoDB C Driver when built with the Windows platform TLS
| backend. A remote endpoint that the client connects to can cause the
| driver to write uncontrolled data outside the bounds of a heap
| allocation while processing incoming encrypted traffic after the TLS
| handshake completes. No authentication or user interaction is
| required, because the affected processing occurs before any
| application-level authentication completes. Triggering this issue
| may lead to memory corruption in the client process, disclosure of
| adjacent heap memory, or termination of the process.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93393
https://www.cve.org/CVERecord?id=CVE-2026-93393
[1] https://jira.mongodb.org/browse/CDRIVER-6417

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hi Salvatore,

Note that this vulnerability only exists when mongo-c-driver is built
with components that are only available on Windows. Based on that, I
would recommend that this vulnerability be triaged as <unimportant>. (I
don't think that we have support for a does-not-affect-debian-binary
state yet.)

The fix will be included in the next unstable upload (either 2.5.5 or
2.6.0, I forget which is coming next). But it is not worth the
effort/risk to backport the fix to trixie and bookworm.

Regards,