CVE-2024-6383

What it actually does

The bson_string_append function in libbson can miscalculate buffer size during string append operations, resulting in an undersized allocation that corrupts adjacent heap memory.

Why it matters to the business

Applications built with affected libbson versions may experience unexpected crashes, data corruption, or degraded service availability when processing certain BSON inputs over the network.

How an attack unfolds

An attacker sends a crafted BSON document containing a string that triggers the miscalculation in bson_string_append; the resulting heap corruption can be leveraged to alter control data or cause denial of service without requiring authentication.

How to fix it

Upgrade all consumers of libbson to version 1.27.1 or later; rebuild and redeploy dependent applications after the library update.

How to confirm the fix worked

Confirm the running libbson shared object or static archive reports version 1.27.1 or higher; exercise BSON string append paths with boundary-case inputs in a test harness to verify absence of crashes or corruption.

Typical attack path

1. Identify a network-accessible service that links against a vulnerable libbson version
2. Craft and transmit a BSON payload designed to exercise the bson_string_append path with an oversized or specially formatted string
3. Trigger the undersized allocation and subsequent heap write
4. Observe process crash or attempt to chain corruption into further exploitation primitives

How to detect it

Review application and library logs for unexpected process terminations or heap-related error messages near BSON parsing code; correlate with inbound network traffic containing BSON documents.

What your security team should do

• Inventory all builds and containers that statically or dynamically link libbson and schedule upgrades to 1.27.1+
• Add dependency scanning rules that block builds using libbson < 1.27.1
• Monitor EPSS and exploit maturity signals for any future increase in observed activity