CVE-2026-84968
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
Risk Assessment
Disclosure of process memory fragments may expose sensitive data such as keys, tokens, or other confidential information, potentially facilitating further attacks.
Recommendation
Update the MongoDB PHP driver to a patched version and avoid processing untrusted input in BSON operations.
Other vulnerabilities in MongoDB PHP driver
See all- CVE-2026-96745Medium
A deserialization vulnerability in the command monitoring support of the MongoDB PHP Driver can cause class names from document content to be honored when building monitoring events. An attacker controlling data in database operations may instantiate application classes implementing the persistable interface and invoke their unserialize method.
- CVE-2026-6811Medium
A stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
Original NVD description (English source)
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.