---
id: "CVE-2026-120954"
kind: "vulnerability"
aliases: ["CVE-2026-120954"]
title: "BSON library: vector data arithmetic wraparound on 32-bit builds corrupts parsed results"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["32-bit", "bson", "package", "untrusted-input"]
not_affected_if: ["64-bit-build", "trusted-input-only"]
published_at: "2026-11-03T19:18:00+00:00"
first_seen_at: "2026-11-03T19:44:52+00:00"
updated_at: "2026-11-03T19:45:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120954", "first_seen_at": "2026-11-03T19:44:52+00:00"}]
---

# BSON library: vector data arithmetic wraparound on 32-bit builds corrupts parsed results

The BSON library miscalculates the element count of a binary vector type when an attacker supplies an oversized value, on 32-bit builds. An application parsing untrusted BSON can silently process only part of the data while reporting success, so results are wrong but memory is not affected and no data is disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify the BSON library and version in use (for example, check the dependency manifest or lockfile) and confirm whether it is a build for a 32-bit platform.
- Check whether the application parses untrusted BSON containing the binary vector data type.

## Timeline

- 2026-11-03T19:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120954

## From the sources

A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_