CVE-2026-106432
Low · 3.6CVSS
3.6
EPSS
0.2%
Published
Oct 8, 2026
CISA due date
—
The record
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-98049 In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the… CWE-681
- CVE-2026-88387 LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in… CWE-681
- CVE-2026-77412 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-681
- CVE-2026-84970 A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++… CWE-681
- CVE-2026-82522 libjxl before 0.12 contains an integer underflow vulnerability in the container box… CWE-681
- CVE-2026-75145 FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the… CWE-681
- CVE-2026-19879 A flaw was found in Undertow, an HTTP server, within its HTTP response header writing… CWE-681
- CVE-2026-21069 Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR… CWE-681