CVE-2025-0755: MongoDB C Driver bson library may be susceptible to buffer overflow

Description

The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 56% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MO

MongoDB · MongoDB

7.0.0 before 7.0.16; 8.0.0 · source: NVD

MS

MongoDB Server · MongoDB Inc

8.0 before 8.0.1; 7.0 before 7.0.16 · source: vendor

LI

libbson · MongoDB Inc

before 1.27.5 · source: vendor, NVD