Description

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-09-03T15:17:36.403Z",
  "pubdate": "2026-09-03T15:17:36.403Z",
  "executiveSummary": "A critical numeric truncation vulnerability has been identified within the JSON parsing component of the MongoDB C++ Driver's BSON library. This flaw allows an attacker capable of controlling the input text parsed by the library to trigger memory corruption, unauthorized data disclosure, or process termination.\nThe vulnerability manifests when the library processes excessively large JSON inputs, resulting in improper memory boundary handling. An attacker can leverage this condition to force the library to read memory beyond the allocated buffer boundaries, potentially exposing sensitive data stored within the process memory space.\nThe scope of this vulnerability is strictly confined to the application process utilizing the affected BSON library. No interaction with a MongoDB server is required, nor are specific authentication or elevated privileges necessary, as the attack surface is exposed directly through the public JSON parsing interface.\nThe risk implication is significant for applications that process untrusted or malformed JSON payloads, as the vulnerability can lead to information disclosure or a denial-of-service state through abnormal process termination. Developers must prioritize updating the driver to address the underlying integer handling logic.",
  "technicalDetails": "The vulnerability originates from a numeric truncation error during the calculation of buffer sizes within the JSON parser of the MongoDB C++ Driver's BSON implementation. When the library receives a sufficiently large JSON string, the integer type responsible for tracking the remaining bytes or buffer length undergoes an implicit truncation. This occurs because the internal length calculation fails to account for 64-bit integer overflows or unsigned integer wraps when processing large input sizes, leading to a discrepancy between the expected buffer size and the actual number of bytes processed.\nThe exploitation flow begins with the delivery of a maliciously crafted, oversized JSON document to the library's public parsing API. Upon processing, the truncated length value causes the parser to bypass standard bounds checks. This permits the parser to continue reading past the end of the input buffer, effectively performing an out-of-bounds read. Depending on the memory layout of the host process, this read operation can result in the library returning portions of adjacent heap or stack memory back to the application caller, leading to a leakage of sensitive information.\nAlternatively, the inconsistency introduced by the truncation can cause the parser to prematurely interpret a partial input as a complete, valid BSON document. This can lead to logical flaws within the embedding application if it relies on the integrity of the returned document. In more severe scenarios, the library may attempt to dereference invalid memory locations triggered by the misaligned read, resulting in a segmentation fault and immediate termination of the process, thereby causing a denial-of-service condition.\nThe vulnerability is inherent to the parsing logic and does not rely on external network configuration or server-side interactions. Any application leveraging the vulnerable version of the MongoDB C++ Driver to process JSON from untrusted sources is susceptible. Because the flaw exists in the deserialization stage, exploitation occurs locally within the memory space of the service utilizing the library, meaning an attacker only requires the ability to submit input to a function call that eventually passes the data to the JSON parsing routine. Mitigation necessitates a code-level fix to ensure that buffer size validation logic is robust against integer overflow and truncation across all architectures."
}