Vulnerability · Published Oct 8, 2026 · Assigned by mongodb
CVE-2026-106432Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
Low 3.6
In plain English
A low-severity security flaw in PHP Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | php-mongodb | no fix listed | DEBIAN-CVE-2026-106432 |
| Debian:13 | php-mongodb | 2.0.0-1+deb13u2 | DEBIAN-CVE-2026-106432 |
| Debian:14 | php-mongodb | 2.5.5-1 | DEBIAN-CVE-2026-106432 |
| Ubuntu:22.04:LTS | php-mongodb | no fix listed | UBUNTU-CVE-2026-106432 |
| Ubuntu:24.04:LTS | php-mongodb | no fix listed | UBUNTU-CVE-2026-106432 |
| Ubuntu:26.04:LTS | php-mongodb | no fix listed | UBUNTU-CVE-2026-106432 |
| Ubuntu:26.10 | php-mongodb | no fix listed | UBUNTU-CVE-2026-106432 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | PHP Driver | 1.16.0 – before 1.21.112.0.0 – before 2.1.112.2.0 – before 2.5.4 |
Weakness: CWE-681 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L