CVE-2026-84968

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/PHPC-2744	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mongodb:php_driver::::::mongodb::*
	cpe:2.3:a:mongodb:php_driver::::::mongodb::*
	cpe:2.3:a:mongodb:php_driver::::::mongodb::*

History

No history.

Information

Published : 2026-09-03 18:17

Updated : 2026-09-10 20:39

NVD link : CVE-2026-84968

Mitre link : CVE-2026-84968

CVE.ORG link : CVE-2026-84968

JSON object : View

Products Affected

mongodb

php_driver

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-84968", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-84968", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-03T17:30:52.642212Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB", "product": "PHP Driver", "versions": [{"status": "affected", "version": "1.15.0", "lessThan": "1.21.8", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.1.9", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-03T18:17:33.010", "references": [{"url": "https://jira.mongodb.org/browse/PHPC-2744", "tags": ["Vendor Advisory"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents."}], "lastModified": "2026-09-10T20:39:21.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*", "vulnerable": true, "matchCriteriaId": "053D3AD2-CC40-4586-A09D-16863CF28389", "versionEndExcluding": "1.21.9", "versionStartIncluding": "1.15.0"}, {"criteria": "cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*", "vulnerable": true, "matchCriteriaId": "B7A31531-1634-4ACA-BC0B-60969DA389E6", "versionEndExcluding": "2.1.9", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*", "vulnerable": true, "matchCriteriaId": "4D218C1E-7818-4418-9EFC-5A6B0ACE3D23", "versionEndExcluding": "2.5.2", "versionStartIncluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}