CVE-2026-106432

Name of the Vulnerable Software and Affected Versions MongoDB PHP Driver (affected versions not specified)

Description The BSON encoder converts a string length to a 32-bit value without proper validation. If an application encodes a string close to 4 GiB, the allocation size may wrap around while the copy operation continues to use the original length. This leads to a heap buffer overflow, which can corrupt process memory or cause the PHP process to terminate. This issue requires a non-default runtime configuration that allows multi-gigabyte values and does not require interaction with a MongoDB server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.