CVE & CISA-KEV Catalog

CVE-2024-6381

MEDIUM

4.0

CVSS v3

Description

The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2

How to fix

Remediation Available

libbson-xs-perlDebian

Fixed in:0.8.4-1+deb11u1CVE-2024-6381

Fixed in:0.8.4-2+deb12u1CVE-2024-6381

libbson-1.0-0Ubuntu

Fixed in:1.16.1-1ubuntu0.1~esm1USN-7613-1

Fixed in:1.21.0-1ubuntu0.1~esm1USN-7613-1

libbson-1.0-0t64Ubuntu

Fixed in:1.26.0-1.1ubuntu2+esm1USN-7613-1

libbson-devUbuntu

Fixed in:1.16.1-1ubuntu0.1~esm1USN-7613-1

Fixed in:1.21.0-1ubuntu0.1~esm1USN-7613-1

Fixed in:1.26.0-1.1ubuntu2+esm1USN-7613-1

libmongoc-1.0-0Ubuntu

Fixed in:1.16.1-1ubuntu0.1~esm1USN-7613-1

Fixed in:1.21.0-1ubuntu0.1~esm1USN-7613-1

libmongoc-1.0-0t64Ubuntu

Fixed in:1.26.0-1.1ubuntu2+esm1USN-7613-1

libmongoc-devUbuntu

Fixed in:1.21.0-1ubuntu0.1~esm1USN-7613-1

Fixed in:1.26.0-1.1ubuntu2+esm1USN-7613-1

mongo-c-driverUbuntu

Fixed in:1.16.1-1ubuntu0.1~esm1USN-7613-1

Fixed in:1.21.0-1ubuntu0.1~esm1USN-7613-1

Fixed in:1.26.0-1.1ubuntu2+esm1USN-7613-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploit Intelligence

0.39%probability of exploitation in 30 days

31stpercentile

Low risk: more likely to be exploited than 31% of all known CVEs.

References

Vendor Advisory1

jira.mongodb.org

Other references2

Embed a live status badge for CVE-2024-6381

Markdown

[![CVE-2024-6381](https://tridentstack.com/cve/badge/CVE-2024-6381.svg)](https://tridentstack.com/cve/CVE-2024-6381)

HTML

<a href="https://tridentstack.com/cve/CVE-2024-6381"><img src="https://tridentstack.com/cve/badge/CVE-2024-6381.svg" alt="CVE-2024-6381"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-11-03.