The BSON encoder in the MongoDB PHP Driver converts a string length to a 32‑bit value without validating the size. When an application encodes a string that approaches 4 GiB, the allocated buffer size can wrap back to a small value while the copy operation still uses the original, huge length. This heap buffer overflow can corrupt process memory or cause the PHP process to terminate. The flaw exists only within the driver and does not require any interaction with a MongoDB server. The potential impact is limited to memory corruption and a crash of the PHP application.

MongoDB PHP Driver is the affected product. No specific version range was provided, so any installation that includes the unpatched BSON encoder is susceptible.

The CVSS score of 2 indicates a low severity assessment. EPSS is not available and the flaw is not listed in CISA’s KEV catalog. Exploitation requires a runtime configuration that permits strings close to the 4‑GiB boundary; the default configuration typically mitigates this scenario. If an attacker can supply large strings to a PHP application that uses the driver, they could potentially trigger the overflow and crash the process, but a successful exploitation would not provide an attacker with code execution or persistence. The vulnerability is therefore considered low risk under typical configurations but could become more serious in a scenario where large payloads are accepted without validation.