{"id":"CVE-2026-120954","title":"Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views","summary":"A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-190"],"vendor":"MongoDB","product":"C Driver","affected":["c_driver >= 2.0.0 <= 2.5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T19:42:04.160779Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T19:42:13.241Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120954","references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-6420"}],"tags":["cve.org"],"epss":0.00233,"epssPercentile":0.14254,"ingestedAt":"2026-11-05T20:33:06.403Z","slug":"CVE-2026-120954","body":"## Overview\n\nA weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.\n\n## Affected\n\n- `c_driver >= 2.0.0 <= 2.5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}