{"id":"CVE-2026-120954","kind":"vulnerability","aliases":["CVE-2026-120954"],"related":[],"title":"BSON library: vector data arithmetic wraparound on 32-bit builds corrupts parsed results","description":"A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.","summary":"The BSON library miscalculates the element count of a binary vector type when an attacker supplies an oversized value, on 32-bit builds. An application parsing untrusted BSON can silently process only part of the data while reporting success, so results are wrong but memory is not affected and no data is disclosed.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["32-bit","bson","package","untrusted-input"],"not_affected_if":["64-bit-build","trusted-input-only"],"how_to_check":"- Identify the BSON library and version in use (for example, check the dependency manifest or lockfile) and confirm whether it is a build for a 32-bit platform.\n- Check whether the application parses untrusted BSON containing the binary vector data type.","fix":null,"status":"open","published_at":"2026-11-03T19:18:00+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","triaged_at":"2026-11-03T19:45:42+00:00","updated_at":"2026-11-03T19:45:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T19:45:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BSON library: vector data arithmetic wraparound on 32-bit builds corrupts parsed results","impact":"low","summary":"The BSON library miscalculates the element count of a binary vector type when an attacker supplies an oversized value, on 32-bit builds. An application parsing untrusted BSON can silently process only part of the data while reporting success, so results are wrong but memory is not affected and no data is disclosed.","audience":"developers","category":"package","nicknames":[],"who_cares":["bson","32-bit","untrusted-input"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Parsed vector data is silently truncated, giving wrong results without an error","analyst_note":"","how_to_check":"- Identify the BSON library and version in use (for example, check the dependency manifest or lockfile) and confirm whether it is a build for a 32-bit platform.\n- Check whether the application parses untrusted BSON containing the binary vector data type.","plain_action":"","needs_analyst":false,"not_affected_if":["64-bit-build","trusted-input-only"],"who_is_affected":"Applications that parse untrusted BSON data containing the specialized binary vector type, built for 32-bit platforms, are affected. 64-bit builds of the same library are reported to behave differently. Teams that only handle trusted BSON, or run 64-bit builds, can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4223,"output_tokens":532,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120954':16A,19A '-2026':15A,18A '32':8A,20B,47B,121C '64':159C 'accessor':156C 'affect':74B,192C 'allow':95C 'applic':51B,124C,176C 'arithmet':5A,97C 'attack':41B,110C 'attacker-suppli':109C 'authent':167C 'beyond':173C 'binari':36B,91C 'bit':9A,21B,48B,122C,160C 'bson':1A,22B,28B,54B,84C,128C 'build':10A,49B,114C,161C 'byte':154C 'byte-ori':153C 'comput':100C 'corrupt':11A 'count':33B 'cve':14A,17A 'data':4A,62B,77B,93C,129C,180C,186C 'describ':105C 'disagre':151C 'disclos':79B,197C 'element':32B,104C,142C 'fraction':138C 'get':174C 'handl':87C 'impact':182C 'inform':195C 'input':26B 'integr':187C 'interact':170C 'librari':2A,29B,85C,165C 'limit':184C 'made':132C 'memori':71B,188C 'miscalcul':30B 'number':102C 'oper':145C 'orient':155C 'overs':44B,108C 'packag':23B 'pars':12A,52B,126C,178C 'part':59B 'platform':117C 'process':57B,134C 'produc':148C 'report':64B,146C 'requir':172C 'result':13A,67B,149C 'safeti':189C 'silent':56B 'size':119C 'small':137C 'special':90C 'success':65B,147C 'suppli':42B,111C,141C 'type':38B,94C 'untrust':25B,53B,127C 'untrusted-input':24B 'user':169C 'valu':45B,112C 'vector':3A,37B,92C 'weak':81C 'word':118C 'wraparound':6A,98C 'wrong':69B","nicknames":[],"mitigations":[],"who_affected":"Applications that parse untrusted BSON data containing the specialized binary vector type, built for 32-bit platforms, are affected. 64-bit builds of the same library are reported to behave differently. Teams that only handle trusted BSON, or run 64-bit builds, can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["32bit","bson","medium","package","untrustedinput"],"campaign_type":null,"first_public_at":"2026-11-03T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120954","severity":null,"published_at":"2026-11-03T19:18:00+00:00","modified_at":"2026-11-03T19:18:00+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}