CVE-2026-106435: CWE-125: Out-of-bounds Read in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator has a buffer over-read vulnerability (CWE-125) caused by decoding malformed BSON with a truncated regular-expression element missing a trailing NUL byte. This leads to an out-of-bounds read in the C extension code, which can cause the application process to crash. The vulnerability requires an attacker to supply BSON data to the documented decode or decode_all API. The normal database wire-protocol path does not reach the vulnerable code. Affected versions are from 0.10.3 through 4.18.2 inclusive.

An attacker able to supply BSON data to the decode or decode_all API can cause the application process to terminate due to an out-of-bounds read in the binary accelerator. This results in denial of service but does not allow code execution or data corruption. The vulnerability does not affect the normal database communication path, limiting the attack surface to applications that explicitly use the vulnerable decode APIs with untrusted BSON input.

No patch or official fix information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid decoding untrusted BSON data using the decode or decode_all API with the binary accelerator enabled. Consider disabling the C extension if possible to prevent triggering the vulnerable code path.