CVE-2026-106432

The MongoDB PHP Driver contains a heap buffer overflow vulnerability within its BSON encoder . The root cause is the conversion of string lengths to 32-bit values without proper validation; when encoding strings near 4 GiB , the allocation size can wrap while the copy operation maintains the orig...

CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...