MongoDB PHP Driver EUVD-2026-95234

Exploitation requires a non-default runtime configuration of the MongoDB PHP Driver that permits multi-gigabyte values, plus an application code path that BSON-encodes a string near 4 GiB whose length the attacker can influence. The vector is local (AV:L) and needs low privileges (PR:L), and per CVSS 4.0 AT:P a specific attack requirement must be met - namely that oversized-value configuration. No MongoDB server interaction is required. Limiting factors: default configurations are not affected, the attacker must be able to drive allocation of a ~4 GiB string (significant memory and data-control prerequisites), and no user interaction is needed (UI:N) but local access and the enabling configuration sharply narrow the exposed population.

All exploitation-probability signals point to low real-world risk. The vendor-assigned CVSS 4.0 base score is only 2.0 (Low), driven by AV:L (local vector), AT:P (a specific attack requirement - the non-default multi-gigabyte configuration), PR:L (low privileges required), and limited impact (VC:N/VI:L/VA:L). No EPSS score, no CISA KEV listing, and no public POC were provided, so the only confirmed signal is the vendor report itself (MongoDB, via JIRA PHPC-2741) - there is no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting: a local, config-dependent integer-truncation bug (CWE-681) that at worst corrupts memory or crashes the PHP process is correctly rated Low. The practical ceiling here is a denial of service / memory corruption of the local PHP process, not remote compromise. This is NOT a priority patch for most environments; it matters only where applications are deliberately configured to handle multi-gigabyte BSON string values. Note: the realistic impact appears to be primarily availability (process termination) with possible integrity effects from heap corruption, matching VI:L/VA:L.

A PHP application running the MongoDB PHP Driver is configured in a non-default mode that permits multi-gigabyte values, and it BSON-encodes attacker-influenced data. An actor with low-privilege local access supplies (or causes the application to construct) a string near 4 GiB, so the 32-bit length truncation under-allocates the buffer while the copy uses the full length, producing a heap overflow that corrupts memory or crashes the PHP process. No public exploit code is known, and no MongoDB server interaction is required.