CVE-2026-84968

EUVD-2026-70644
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mongodbCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mongodbphp_driver
1.15.0 ≤
𝑥
< 1.21.8
CNA
mongodbphp_driver
2.0.0 ≤
𝑥
< 2.5.1
CNA
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/PHPC-2744