Integer Overflow in MongoDB Python Driver's BSON Encoding Component

CVE-2026-96749

What is CVE-2026-96749?

An integer overflow vulnerability exists in the BSON document encoding component of the MongoDB Python Driver's bundled native extension. This occurs when a document is created from an excessively large volume of user-supplied data. The arithmetic operations managing size are conducted using a signed 32-bit type, leading to potential risks when the overflow guard fails due to undefined behavior, as dictated by the C language standard. If exploited, an unauthorized actor could input a large value, resulting in a buffer overflow that may allow the execution of arbitrary code within the application's process.

References