CVE-2026-84968 — Heap out-of-bounds read via corrupt nested BSON in field path error message

CVE-2026-84968

Heap out-of-bounds read via corrupt nested BSON in field path error message PUBLISHED

Description (CNA)

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

Affected (CNA)

Vendor / product	Versions
MongoDB / PHP Driver	affected 1.15.0 before 1.21.8; affected 2.0.0 before 2.1.9; affected 2.2.0 before 2.5.1

CWE

CWE-125

References

https://jira.mongodb.org/browse/PHPC-2744

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.