{"id":"CVE-2026-96749","summary":"Heap out-of-bounds write via signed size overflow in BSON document encoding","details":"An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process.","aliases":["GHSA-v4x9-3549-crwv"],"modified":"2026-09-26T08:07:53.045702Z","published":"2026-09-24T18:18:13.077Z","database_specific":{"cna_assigner":"mongodb","cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96749.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"1.9.0"},{"fixed":"4.18.2"}]}]},"references":[{"type":"WEB","url":"https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"},{"type":"WEB","url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96749.json"},{"type":"ADVISORY","url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96749"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mongodb/mongo-python-driver","events":[{"introduced":"0"},{"fixed":"640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7"}],"database_specific":{"source":"REFERENCES"}}],"versions":["4.18.1","4.18.0","4.16.0","4.16.0.dev0","4.15.1","4.15.0","4.13.0","4.13.0.dev1","4.13.0.dev0","4.12.0","4.11","4.10.1","4.10.0","4.9.1","4.9","4.7.1","4.7.0","4.6.0","4.5.0","4.4.0","4.4.0b0","4.3.3","4.3.2","4.3.1","4.3.0","4.2.0","4.2.0b0","4.1.1","4.1.0","4.0","3.11.1","3.11.0","3.11.0rc0","3.11.0b1","3.11.0b0","3.10.1","3.10.0","3.9.0","3.9.0b1","3.9.0b0","3.7.0","3.7.0b0","3.6.1","3.6.0","3.6rc0","3.5.1","3.5.0","3.4.0","3.3.0","3.4rc0","3.2.2","3.2.1","3.2","3.2rc0","3.1.1","3.1","3.1rc0","3.0.3","3.0.2","3.0.1","3.0","3.0rc1","3.0rc0","3.0b1","3.0b0","2.7","2.7rc1","2.7rc0","2.6","2.5.1","2.5","2.4.2","2.4.1","2.4","2.3","2.3rc1","2.2.1","2.2","2.2rc1","2.1","2.1.1","2.0.1","2.0","1.11","1.10.1","1.10","1.9","1.8.1","1.8","1.7","1.6","1.5.1","1.5","1.4","1.3","1.2.1","1.2","1.1.2","1.1.1","1.1","1.0","0.16","0.15.2","0.15.1","0.15","0.14.2","0.14.1","0.14","0.13","0.12","0.11.3","0.11.2","0.11.1","0.11","0.10.3","0.10.2","0.10.1","0.10","0.9.5","0.9.4","0.9.3","0.9.2","0.9.1","0.9","0.8.1","0.8","0.7.2","0.7.1","0.7","0.6","0.5.3pre","0.5.2pre","0.5.1pre","0.5pre","0.4pre"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96749.json","vanir_signatures_modified":"2026-09-26T08:07:53Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7","target":{"file":"bson/buffer.c"},"deprecated":false,"digest":{"line_hashes":["313937259246690792033577136582351186585","234329394194398214755767972931697391149","205556081000686217523895440862638542136","302023848532793530739864523738009957657","229744238530264298010148702012829395894","289566845193397341247368850510323650999","61373660942318224200464922469282204245","1377657727013732018681638084855295901","100276382119081194731334726091889527063","49150128683341948243584376855512715628","282432437761933900027570562394692470410","161491051014087500058901029099508351084","79846178355188504907962075812862958840","339487331988713150960607797990096285080"],"threshold":0.9},"id":"CVE-2026-96749-5d3a46dc","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"306396228315852703488053070048897984029","length":295},"id":"CVE-2026-96749-ccd4fb31","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7","target":{"file":"bson/buffer.c","function":"buffer_assure_space"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}