CVE-2026-84968: CWE-125: Out-of-bounds Read in MongoDB PHP Driver

This vulnerability (CVE-2026-84968) involves an out-of-bounds read in the BSON decoding logic of the MongoDB PHP driver. When processing specially crafted input, the driver may read beyond the intended buffer boundaries and include adjacent memory contents in error messages sent back to the application. This can result in limited disclosure of process memory to an unauthenticated attacker. The affected versions are >=1.15.0 <1.21.8, >=2.0.0 <2.1.9, and >=2.2.0 <2.5.1. There are no known exploits in the wild, and no official patch or remediation details were provided in the input data.

An unauthenticated attacker can cause the MongoDB PHP driver to disclose a small amount of adjacent process memory via error messages. This could reveal sensitive information contained in memory, but the exposure is limited in scope. There is no indication of remote code execution or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links were provided, users should monitor MongoDB's official channels for updates. Until a fix is available, consider restricting access to the MongoDB PHP driver interfaces and validate inputs to reduce the risk of triggering this vulnerability.