Live › vulnerability › CVE-2026-120954
The BSON library miscalculates the element count of a binary vector type when an attacker supplies an oversized value, on 32-bit builds. An application parsing untrusted BSON can silently process only part of the data while reporting success, so results are wrong but memory is not affected and no data is disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Applications that parse untrusted BSON data containing the specialized binary vector type, built for 32-bit platforms, are affected. 64-bit builds of the same library are reported to behave differently. Teams that only handle trusted BSON, or run 64-bit builds, can likely skip it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.
This page as .md · .json · in your agent: get_signal("CVE-2026-120954")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.