CVE-2026-84964

CVE-2026-84964 is a double free (CWE-415) in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver. It is triggered during a TLS handshake with an endpoint the client already trusts: specially formed certificate data from that endpoint causes the same heap object to be released twice, so an unauthenticated party positioned as the trusted TLS endpoint (for example a compromised or impersonated trusted server) can crash the connecting client application. The impact is availability only — the client process terminates unexpectedly — with no confidentiality or integrity impact per the CVSS 4.0 scores. Affected parties are operators of applications that embed the MongoDB C Driver and link it against OpenSSL for TLS. Exploitation status: no public proof-of-concept, not listed in CISA KEV, and a low exploitation probability (EPSS 0.1%, 4th percentile), so no known in-the-wild abuse at this time.

What to do: Identify which applications link the MongoDB C Driver against OpenSSL and whether certificate revocation checking is active, then upgrade to the patched release once MongoDB publishes fixed versions (no fixed version is given in the available data). In the interim, ensure clients connect only to trusted, well-hardened MongoDB endpoints, since the attacker must act as the already-trusted TLS endpoint. Monitor the MongoDB security advisory for updates and add this CVE to patch-tracking once remediation details are released.