CVE-2026-84968CWE-125

CVE-2026-84968

Medium · published September 3, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00198 · 9.0th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-09-03T22:17Z
Affected products (3)
ProductVersionsFixed in
mongodb/php_driver≥ 1.15.0, < 1.21.91.21.9
mongodb/php_driver≥ 2.0.0, < 2.1.92.1.9
mongodb/php_driver≥ 2.2.0, < 2.5.22.5.2
References (1)
https://jira.mongodb.org/browse/PHPC-2744 · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 17:03Z
    Heap out-of-bounds read via corrupt nested BSON in field path error message
    cvelistv5