The vulnerability arises from missing lower-bound validation in the bson_new_from_buffer() function of libbson, part of the MongoDB C Driver. The function reads a 32-bit document length from the input buffer but does not verify that it meets the minimum valid BSON document size of 5 bytes. When the length is zero, an integer underflow occurs during an array index calculation, wrapping to UINT32_MAX. This causes a heap out-of-bounds read, resulting in a process crash. The flaw can be triggered by an unauthorized party supplying crafted BSON data, leading to denial of service.

The primary impact is a denial of service due to a heap out-of-bounds read and process crash. There is no indication of privilege escalation, data corruption, or code execution. The vulnerability can be exploited remotely by an attacker who can supply malicious BSON input to an application using the affected MongoDB C Driver versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, applications should validate BSON input length before passing it to the vulnerable function or implement input filtering to prevent zero-length BSON documents.