An out‑of‑bounds read occurs in the BSON decoding portion of the MongoDB PHP driver when a specially crafted nested BSON document triggers the field‑path error message builder. The bug allows an unauthenticated attacker to supply input that causes the driver to copy a small section of adjacent process memory into an error string. The exposed data is limited to a few bytes, but it still represents a disclosure of internal memory contents that could contain sensitive or debug information.

The affected component is the MongoDB:PHP Driver. No specific version range is supplied in the advisory, but any installation of the driver that includes the vulnerable BSON decoding code is susceptible.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker be able to supply arbitrary BSON input to the driver, a condition that typically exists in web applications or services that deserialize user input. Because the disclosure is limited to a few bytes, and no remote code execution or privilege elevation is possible, the overall risk is moderate but not negligible.