CVE-2025-12119
Bulk write with options may read invalid memory
In short
The MongoDB C driver can crash or read sensitive data when someone passes very large option values to bulk write operations. This happens because the code doesn't properly validate the size of these options before processing them.
Technical detail
A buffer overflow vulnerability exists in mongoc_bulk_operation_t when processing oversized options parameters. The vulnerability allows an attacker with the ability to control bulk operation options to trigger out-of-bounds memory reads, potentially leading to information disclosure or denial of service. Affected code lacks proper bounds checking during option parsing.
Summary generated and translated by AI from the official description.
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →