Buffer overflow in Mongodb Libbson
CVE-2025-0755
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
Vulnerability class: Buffer Overflow
EPSS: 0.007 (50.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Mongodb Libbson
- Mongodb — versions 8.0.0
- Mongodb Inc Libbson — versions 0
- Mongodb Inc Server — versions 8.0, 7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@mongodb.com (Issue Tracking, Vendor Advisory)
- cna@mongodb.com (Issue Tracking, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-0755?
- CVE-2025-0755 is a high-severity vulnerability in Mongodb Libbson, classified under Heap-based Buffer Overflow. CVSS score: 8.4/10. Published 2025-03-18.
- How severe is CVE-2025-0755?
- High severity. CVSS v3 base score is 8.4 out of 10.
- Is CVE-2025-0755 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.