---
id: CVE-2026-120954
title: >-
  Silent element-count truncation via 32-bit bit-length overflow in packed-bit
  vector views
summary: >-
  A weakness in the BSON library's handling of a specialized binary vector data
  type allows an arithmetic wraparound when computing the number of elements
  described by an oversized attacker-supplied value. On builds where the
  platform word…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-190
vendor: MongoDB
product: C Driver
affected:
  - c_driver >= 2.0.0 <= 2.5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T19:42:04.160779Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:42:13.241Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120954'
references:
  - url: 'https://jira.mongodb.org/browse/CDRIVER-6420'
tags:
  - cve.org
epss: 0.00233
epssPercentile: 0.14206
ingestedAt: '2026-11-05T20:33:06.403Z'
---

## Overview

A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.

## Affected

- `c_driver >= 2.0.0 <= 2.5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.