Description

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.1",
  "pubDate": "2026-09-03T16:18:25.417Z",
  "pubdate": "2026-09-03T16:18:25.417Z",
  "executiveSummary": "This vulnerability involves an integer wraparound flaw occurring during the calculation of allocation sizes within the BSON library's JSON parsing module.\nThe vulnerability primarily affects 32-bit architectural builds of applications utilizing the library, where the calculation logic fails to handle large input sizes correctly.\nBy supplying a maliciously crafted, oversized JSON payload, an unauthenticated attacker can trigger a memory management failure. Specifically, the flaw leads to a buffer being deallocated while subsequent operations continue to access the stale memory address, resulting in a use-after-free or invalid memory write scenario.\nThe primary security impact is an unexpected application termination, resulting in a Denial of Service (DoS) condition. As the exploit is triggered through standard input processing, no prior authentication or elevated privileges are required, making it a significant availability risk for internet-facing applications that parse untrusted JSON input using this library.",
  "technicalDetails": "The root cause of this vulnerability is an integer overflow in the memory allocation size calculation logic when processing JSON data. In environments where the size type is restricted to 32 bits, a sufficiently large input size calculation causes an integer wraparound.\nWhen the input size exceeds the maximum representable value of the 32-bit integer, the arithmetic operation wraps around to a significantly smaller value. This smaller value is subsequently used to allocate a memory buffer that is insufficient to hold the intended data payload.\nThe exploitation flow begins when an attacker provides a crafted JSON input designed to trigger this wraparound. The application proceeds to allocate this truncated buffer. Following the allocation, the parsing logic initiates a copy operation intended to move the input data into the heap-allocated memory.\nDue to the discrepancy between the expected data size and the actual allocated buffer size, the library may initiate a memory cleanup or re-allocation process prematurely. If the logic incorrectly triggers the release (freeing) of the buffer while the copy operation is still active, the process maintains a pointer to the now-freed memory region.\nThe subsequent write operation attempts to commit the remaining data into this stale (dangling) pointer. This behavior results in a memory corruption event or a segmentation fault, forcing the application to terminate unexpectedly.\nThis vulnerability is strictly tied to the memory management implementation within the BSON library's JSON parsing functionality. Because it relies on the parsing of externally supplied JSON, the vulnerability is exposed to any network-facing component that accepts input through this library. The lack of proper bounds checking or overflow validation in the size arithmetic allows the input to bypass standard security buffers."
}