Integer overflow in mongo-python-driver - CVE-2026-96749
Published: September 24, 2026
Vulnerability identifier: #VU151936
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96749
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write outside the bounds of an allocated buffer.
The vulnerability exists due to an integer overflow in the BSON document encoding component of the bundled native extension when encoding a document built from an unusually large amount of caller-supplied data. A remote attacker can supply an unusually large value for encoding to write outside the bounds of an allocated buffer.
Exploitation depends on how the native extension was built.
Affected software
mongo-python-driver
How to mitigate CVE-2026-96749
Install security update from vendor's website.
mongo-python-driver - update to 4.18.2