Out-of-Bounds Read Vulnerability in MongoDB PHP Driver
CVE-2026-84968

6.9MEDIUM

Key Information:

Vendor

Mongodb
Status
PHP Driver
Vendor
CVE Published:
3 September 2026

What is CVE-2026-84968?

An out-of-bounds read vulnerability in the BSON decoding component of the MongoDB PHP driver could allow an unauthenticated attacker to manipulate specially crafted input. This could result in a portion of adjacent process memory being exposed through error messages returned to the application. Consequently, this may lead to the unintended disclosure of sensitive information, posing a potential security risk for applications utilizing the affected driver.

Affected Version(s)

PHP Driver 1.15.0 < 1.21.8

PHP Driver 2.0.0 < 2.5.1

References

https://jira.mongodb.org/browse/PHPC-2744

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.