CVE-2025-0755CWE-122

MongoDB C Driver bson library may be susceptible to buffer overflow

High · published March 18, 2025

CVSS v3.1
8.4
EPSS
1%
Percentile
55.7
In the wild
Unconfirmed
What it is

The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00788 · 55.7th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-03-18T09:01Z
EPSS history
Timeline
  • 18 MAR 09:01Z
    MongoDB C Driver bson library may be susceptible to buffer overflow
    cvelistv5