Description

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-03T18:17:33.010Z",
  "pubdate": "2026-09-03T18:17:33.010Z",
  "executiveSummary": "The MongoDB PHP driver contains an out-of-bounds (OOB) read vulnerability within its BSON decoding component.\nThis flaw allows an unauthenticated remote attacker to trigger memory corruption, resulting in the leakage of adjacent process memory.\nThe compromised memory contents are subsequently included in error messages returned to the application, creating a vector for information disclosure.\nThe vulnerability poses a significant risk to data confidentiality, as sensitive internal memory segments could be exposed to unauthorized parties.\nExploitation requires the attacker to submit specially crafted BSON input to the application, which is then processed by the vulnerable driver.\nNo authentication is required to initiate this attack, making it reachable from any network-accessible endpoint that utilizes the driver to process untrusted BSON data.",
  "technicalDetails": "The vulnerability resides in the BSON decoding logic of the MongoDB PHP driver, specifically within the routines responsible for parsing BSON structures.\nThe root cause is a failure to properly validate length fields or internal boundaries during the decoding process, leading the parser to read beyond the intended buffer limits.\nWhen the BSON parser encounters a malformed input—such as a type identifier or a length prefix that mismatches the actual data provided—the driver may attempt to access adjacent heap or stack memory.\nThe attack flow begins when an unauthenticated actor submits a crafted BSON payload to an application endpoint that invokes the driver's decoding functions.\nAs the parser processes the malicious input, the improper bounds checking allows the driver to copy bytes located immediately after the input buffer into an internal result structure.\nBecause these error conditions are handled by throwing exceptions that incorporate details from the failed parsing attempt, the leaked memory is inadvertently encapsulated in the resulting error message string.\nIf the application does not strictly sanitize or mask error messages before returning them to the user, the attacker can view the leaked process memory directly in the HTTP response.\nThe impact of this disclosure depends on the contents of the leaked memory, which may contain sensitive information such as cryptographic keys, session tokens, pointers, or other user-specific data residing in the heap.\nBecause the driver operates at the process level, this OOB read can effectively bypass standard application-layer security controls, as it exploits the underlying C-based logic within the PHP extension."
}