Arithmetic Wraparound Flaw in BSON Library Affecting MongoDB Applications

CVE-2026-120954

What is CVE-2026-120954?

A vulnerability exists in the BSON library used by MongoDB that can lead to an arithmetic wraparound when processing oversized values from untrusted BSON data. On 32-bit platforms, this flaw allows applications to interpret only a fraction of provided elements, misleadingly reporting a success status while causing data inconsistency. This issue does not require user authentication or interaction, making it a significant concern for applications that parse BSON data. Although memory safety is maintained, the integrity of the data processed can be compromised, potentially leading to erroneous outcomes.

References