The BSON encoder in the MongoDB PHP Driver converts string lengths to a 32‑bit value without validation. When an application encodes a string near 4 GiB, the allocated buffer size can wrap while the copy still uses the original large length. This heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching the issue requires a non‑default runtime configuration that permits multi‑gigabyte strings; no interaction with the MongoDB server is required.

MongoDB PHP Driver is the affected product. All installations that include the unpatched BSON encoder are vulnerable, regardless of specific version. The flaw exists only within the driver; MongoDB server interaction is not needed.

The CVSS score of 2 indicates a low severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a runtime configuration that allows strings close to the 4‑GiB boundary; the default configuration typically mitigates this scenario. If an attacker can supply large strings to a PHP application using the driver, they could trigger an overflow, potentially corrupting memory or causing a crash, but the flaw does not provide code execution or persistence. Therefore, the risk is low under typical configurations, though it could be higher in environments accepting large payloads without validation.