MongoDB PHP Driver CVE-2026-112368

Exploitation requires that the PHP application pass attacker-controlled binary BSON data into the MongoDB PHP driver's BSON decoding path (e.g., deserializing untrusted BSON via the driver rather than only decoding trusted responses from a MongoDB server). The attacker must be able to deliver a crafted, recursively nested BSON document to that code path; no authentication is needed (PR:N) and no user interaction is required (UI:N). The key limiting factor (reflected as AT:P in the CVSS 4.0 vector) is this deployment condition: applications that only decode BSON originating from a trusted database are largely unexposed, while those accepting BSON from clients or external sources are directly at risk. Because the recursion fault occurs in native code below the PHP layer, standard PHP exception/error handling cannot intercept or mitigate the crash.

This is a genuine but bounded availability risk, not a top-tier priority. The CVSS 4.0 base score of 8.2 is driven entirely by VA:H (high availability impact) with VC:N/VI:N - there is NO confidentiality or integrity impact, so the 'Information Disclosure' tag in the input is incorrect and contradicts the CVSS vector. The vector (AV:N/PR:N/UI:N) indicates a remote, unauthenticated trigger, but AT:P signals that successful exploitation depends on a condition outside the attacker's control: the application must actually feed attacker-supplied BSON data into the driver's decoder. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic worst case is a denial of service (process crash) against PHP applications that decode untrusted BSON; it cannot be used for RCE or data theft. Net: a real, patch-worthy DoS issue whose true exposure hinges on whether the application decodes untrusted binary data, rather than a broadly wormable critical flaw.

An attacker submits a crafted, deeply/recursively nested binary BSON document to a PHP application endpoint that passes untrusted data into the MongoDB PHP driver's BSON decoder. The decoder recurses without bound and exhausts the process stack, crashing the PHP worker and denying service to legitimate users. No authentication is required (PR:N), and because the fault occurs in native code below the PHP layer it cannot be caught by application-level try/catch handling. No public exploit was identified in the provided data.