CVE-2026-106432: CWE-681: Incorrect Conversion between Numeric Types in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver converts string lengths to a 32-bit integer without validating the size. When encoding very large strings close to 4 GiB, the allocation size can wrap around due to integer overflow, but the copy operation uses the original length. This mismatch leads to a heap buffer overflow, which can corrupt memory or crash the PHP process. Exploiting this requires a non-default runtime configuration permitting multi-gigabyte values. The vulnerability affects multiple version ranges of the PHP Driver and does not require MongoDB server interaction.

A heap buffer overflow caused by incorrect numeric conversion can lead to process memory corruption or termination of the PHP process. The impact is limited by the requirement for a non-default runtime configuration that allows multi-gigabyte string values. There are no known exploits in the wild and the CVSS score is low, indicating limited risk under typical usage scenarios.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid configurations that permit multi-gigabyte string values in the BSON encoder until a fix is available.