CVE-2025-12119CWE-825

CVE-2025-12119

Medium · published November 19, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00212 · 11.0th percentile
Weakness
CWE-825 · Expired Pointer Dereference
Published
2025-11-19T03:15Z
Affected products (3)
ProductVersionsFixed in
mongodb/c_driver≥ 1.9.0, < 1.30.61.30.6
mongodb/c_driver≥ 2.0.0, < 2.1.22.1.2
mongodb/php_driver< 1.21.21.21.2
References (4)
https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6 · [email protected]https://github.com/mongodb/mongo-c-driver/releases/tag/2.1.2 · [email protected]https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.2 · [email protected]https://lists.debian.org/debian-lts-announce/2026/01/msg00009.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 18 NOV 20:21Z
    Bulk write with options may read invalid memory
    cvelistv5