Patch Forecast
Amber warning
Patch this week.

CVE-2026-106432

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without…

Risk score
65/100
CVSS
8.2 v3.1
Exploit chance (30 days)
0.2%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate …
Affected
Mongodb Php Driver
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Mongodb Php DriverTHE FLAWSTHE FIXCVE-2026-106432The BSON encoder in theMongoDB PHP Driver converts astring length to a 32-bit value…CVSS 8.2 · EPSS 0%CVE-2026-106436The BSON encoder in theMongoDB PHP Driver does notcheck some return values…CVSS 6.5 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedMongodb Php DriverAMBER · PATCH THIS WEEKMongodb PhpDriverThe BSON encoder in theMongoDB PHP Driver converts astring length to a 32-bit valuewithout validation. When anaffected application encodes astring near 4 GiB, the allocationsize can wrap while the copy…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-681 (CWE-681)12 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Mongodb Php Driver: Amber, patch this week. The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate …

The flaws

  • CVE-2026-106432: The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without… (CVSS 8.2 · EPSS 0%)
  • CVE-2026-106436: The BSON encoder in the MongoDB PHP Driver does not check some return values after a document… (CVSS 6.5 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Mongodb Php Driver

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.2 high
  • Remotely exploitable without logging in
  • On your watchlist: php

References

Original description

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.

Last activity 8 Oct 2026. Patch Forecast updates every hour.