CVE-2026-84968 Heap out-of-bounds read via corrupt nested BSON in field path error message
An attacker can trigger an out-of-bounds read in the MongoDB PHP driver to disclose limited process memory contents via error messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84968?
CVE-2026-84968 is a medium-severity vulnerability in MongoDB PHP Driver, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
Weakness: CWE-125
Which versions are affected by CVE-2026-84968?
It affects 1 product.
Products include Mongodb Php Driver.
How do I fix CVE-2026-84968?
Upgrade to a fixed version.
Is CVE-2026-84968 being exploited?
There is no known exploitation of CVE-2026-84968 in the wild and no public exploit code.
Other vulnerabilities in MongoDB PHP Driver
- CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
- CVE-2026-106436 Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
- CVE-2026-6811 PHP Stack Exhaustion
- CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
Sources
Also known as DEBIAN-CVE-2026-84968, UBUNTU-CVE-2026-84968.