Bulk write with options may read invalid memory
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.2%
exploitation probability
0.2%top 90% of all CVEs
observed exploitation
nono source reports it
In short
The MongoDB C driver can crash or read sensitive data when someone passes very large option values to bulk write operations. This happens because the code doesn't properly validate the size of these options before processing them.
Technical detail
A buffer overflow vulnerability exists in mongoc_bulk_operation_t when processing oversized options parameters. The vulnerability allows an attacker with the ability to control bulk operation options to trigger out-of-bounds memory reads, potentially leading to information disclosure or denial of service. Affected code lacks proper bounds checking during option parsing.
Summary generated and translated by AI from the official description.
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N