Buffer overflow in MongoDB Libbson
CVE-2025-0755
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (53.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 53.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: +0.000
Affected products
- MongoDB Libbson
- MongoDB — versions 8.0.0
- MongoDB Inc Libbson — versions 0
- MongoDB Inc Server — versions 8.0, 7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- jira.mongodb.org/browse/SERVER-94461 (Issue Tracking, Vendor Advisory)
- jira.mongodb.org/browse/CDRIVER-5601 (Issue Tracking, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-0755?
- CVE-2025-0755 is a high-severity vulnerability in MongoDB Libbson, classified under Heap-based Buffer Overflow. CVSS score: 8.4/10. Published 2025-03-18.
- How severe is CVE-2025-0755?
- High severity. CVSS v3 base score is 8.4 out of 10.
- Is CVE-2025-0755 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.