CVE-2026-106432: Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
MongoDB · PHP Driver
Vendor fix available · Affected: MongoDB PHP Driver · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 6% of scored CVEs
DescriptionCVE.org
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- MongoDB · PHP Driverfrom 1.16.0 before 1.21.11; from 2.0.0 before 2.1.11; from 2.2.0 before 2.5.4
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- MongoDB
- Published
- October 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-106432 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.