CVE-2026-106432: MongoDB PHP Driver Buffer Overflow Vulnerability

CVE-2026-106432 Overview

CVE-2026-106432 affects the BSON encoder in the MongoDB PHP Driver. The encoder converts a string length to a 32-bit value without validating the result. When an application encodes a string approaching 4 GiB, the allocation size wraps while the subsequent copy operation uses the original untruncated length. The mismatch produces a heap buffer overflow that can corrupt process memory or terminate the PHP worker process.

Triggering the condition requires a non-default PHP runtime configuration that permits multi-gigabyte string values. No MongoDB server interaction is required to reach the vulnerable code path. The issue is tracked by MongoDB under Jira ticket PHPC-2741.

Critical Impact
A local attacker able to supply oversized string input to BSON encoding can corrupt heap memory or crash the PHP process, leading to denial of service or limited integrity impact.

Affected Products

MongoDB PHP Driver (mongodb/mongodb extension)
PHP applications using the driver with memory_limit configured to allow multi-gigabyte allocations
Server-side PHP workloads encoding attacker-influenced string data via BSON

Discovery Timeline

2026-10-08 - CVE-2026-106432 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-106432

Vulnerability Analysis

The flaw is an incorrect conversion between numeric types, classified under [CWE-681]. The BSON encoder stores a string length value in a 32-bit integer field without checking whether the source length exceeds the representable range. BSON itself constrains string length fields to signed 32-bit values, which creates the truncation boundary at approximately 4 GiB.

When a PHP string of near-4 GiB size reaches the encoder, the length used to size the destination buffer wraps to a small value. The copy operation that follows uses the original length as its count. The resulting write extends past the allocated heap region, corrupting adjacent memory. The attack surface is local because the oversized input must be constructed inside the PHP process.

Root Cause

The root cause is unchecked narrowing of a platform-sized length (size_t or 64-bit integer) into the 32-bit length field required by the BSON wire format. No bounds check rejects strings whose length exceeds INT32_MAX before the allocation is sized. The subsequent memory copy uses the original length, producing a classic allocation-versus-copy mismatch.

Attack Vector

Exploitation requires local code execution in a PHP process that calls the MongoDB driver's BSON encoder on a controlled multi-gigabyte string. The default PHP memory_limit prevents allocations of this size, so the host must be configured with memory_limit = -1 or a value above 4 GiB. The practical impact in production environments is denial of service through process termination. Memory corruption impact is bounded by the layout of the PHP heap at time of the overwrite.

No proof-of-concept exploit code has been published. See the MongoDB Jira ticket PHPC-2741 for upstream remediation details.

Detection Methods for CVE-2026-106432

Indicators of Compromise

Unexpected PHP-FPM or PHP CLI worker crashes with segmentation faults during BSON serialization
Core dumps referencing symbols inside the mongodb extension's BSON writer routines
Error log entries showing memory allocation failures or glibc heap corruption aborts in PHP processes

Detection Strategies

Inventory PHP hosts using the MongoDB extension and compare installed versions against the fixed release noted in PHPC-2741
Flag any PHP configuration (php.ini, pool configs) setting memory_limit to -1 or values at or above 4 GiB
Review application code paths that accept external input and serialize it to BSON without an upstream length cap

Monitoring Recommendations

Monitor PHP worker exit codes and restart rates on servers running the MongoDB driver
Alert on kernel: php[pid]: segfault entries in system logs correlated with MongoDB extension frames
Track process resident set size for PHP workers to identify unusual allocation spikes preceding crashes

How to Mitigate CVE-2026-106432

Immediate Actions Required

Upgrade the MongoDB PHP Driver to the fixed version referenced in PHPC-2741
Reduce PHP memory_limit to a value below 2 GiB on servers that do not require larger allocations
Validate and cap the length of any user-controlled string before passing it to BSON encoding

Patch Information

MongoDB has addressed the issue in the driver release tracked under Jira ticket PHPC-2741. Operators should install the fixed mongodb PECL extension and restart PHP-FPM or the web server to load the patched module.

Workarounds

Set memory_limit in php.ini to a value below 2G to prevent allocation of strings large enough to trigger the overflow
Enforce application-level length validation on all data serialized to BSON documents
Restrict local access to PHP processing nodes to reduce the attacker population able to supply oversized input

bash

# Configuration example: cap PHP memory to block the vulnerable allocation size
# /etc/php/8.3/fpm/php.ini
memory_limit = 512M

# Verify installed MongoDB extension version
php --ri mongodb | grep -i version

# Update the extension via PECL
pecl upgrade mongodb
systemctl restart php-fpm