CVE-2026-84968

    Dashboard / Vulnerabilities / CVE-2026-84968

    CVE-2026-84968

    Published: 3 Sept 2026Last Modified: 12 Sept 2026

    Summary: Heap out-of-bounds read via corrupt nested BSON in field path error message

    Details: An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

    References: https://jira.mongodb.org/browse/PHPC-2744, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84968.json, https://nvd.nist.gov/vuln/detail/CVE-2026-84968

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7a73cdfd4399962b46ecf8a823c0a23e6d77eed8
    Fixed -d67f76efe90a22b231ad6ff652a548bd65b2e5dc

    Affected versions

    2.5.1
    2.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-84968 | CVE-DB