CVE-2026-84968: Heap out-of-bounds read via corrupt nested BSON in field path error message
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the MongoDB PHP driver that decode BSON supplied by an unauthenticated party are exposed if attacker-controlled input can reach the driver's BSON decoding component.
What must an attacker do to exploit it?
An attacker must supply specially formed BSON input containing corrupt nested data. Exploitation does not require authentication or user interaction, according to the supplied severity vector.
What is the likely impact of successful exploitation?
A successful exploit can copy a small amount of adjacent process memory into an error message returned to application code. The described impact is limited unintended information disclosure; no integrity or availability impact is indicated.
How can teams determine whether they may be affected?
Review whether the application uses the MongoDB PHP driver and accepts or processes BSON originating from unauthenticated or otherwise untrusted sources. Also assess whether BSON decoding errors or driver error messages can be exposed beyond trusted application code.