CVE-2026-96749: Heap Out-of-Bounds Write in MongoDB PyMongo BSON Encoder

PyMongo, the official client driver for MongoDB, utilizes a performance-optimized C extension to serialize Python dictionary objects into Binary JSON (BSON) byte streams. The primary logic for tracking and reallocating memory during serialization is handled inside the source file bson/buffer.c.

The native encoder maintains an allocated heap buffer, a pointer tracking the stream's position, and an allocation size parameter. The attack surface is exposed when applications serialize untrusted client-provided documents using PyMongo's encoder. If an attacker can inject excessively large elements into the serialization stream, they can trigger arithmetic operations that overflow the memory allocation limits.

This vulnerability is classified as CWE-190 (Integer Overflow or Wraparound), which directly leads to CWE-122 (Heap-based Buffer Overflow). In systems compiled with standard optimization flags, safety checks designed to protect buffer boundaries are optimized out of the final compiled binary. This logic failure can cause memory corruption, service crashes, or potential code execution.

The underlying flaw resides in the validation logic of the buffer_assure_space function in bson/buffer.c. The function checks whether the native buffer contains enough memory to accommodate incoming serialized BSON elements, attempting to grow the heap buffer if the size limit is exceeded.

The tracking variables buffer->position (current write offset), size (bytes to write), and buffer->size (total capacity) are declared as signed 32-bit integers (int). When a single document contains cumulative serialized elements totaling more than 2GiB, the mathematical operation buffer->position + size exceeds INT_MAX (2,147,483,647) and wraps around to a negative integer.

To prevent this, the developers implemented an overflow guard statement: if (new_size < buffer->position). However, under standard C language specifications, signed integer overflow is classified as Undefined Behavior (UB). Modern optimizing compilers (such as GCC and Clang) assume signed integer overflow is impossible, which permits the compiler to optimize out the guard expression entirely during binary generation.

Furthermore, the logic lacks validation for negative values of the size input parameter. If the compiler strips the overflow guard, the function assumes sufficient space is available and returns success without calling buffer_grow. The serializer then copies raw bytes directly into the under-sized heap buffer, causing a heap-based out-of-bounds write.

Analyzing the vulnerable implementation reveals how compiler optimization undermines safety assumptions when compiling signed integer calculations.

/* Vulnerable code in PyMongo versions prior to 4.18.2 */
static int buffer_assure_space(buffer_t buffer, int size) {
    int new_size = buffer->position + size;
    
    /* Check for overflow. 
     * Highly optimizing compilers strip this conditional block because
     * signed overflow is Undefined Behavior and assumed mathematically impossible. */
    if (new_size < buffer->position) {
        PyErr_SetString(PyExc_ValueError,
                        "Document would overflow BSON size limit");
        return 1;
    }
 
    if (new_size <= buffer->size) {
        return 0;
    }
    return buffer_grow(buffer, new_size);
}

The patched version resolves this vulnerability by ensuring arithmetic operations are calculated in a wider, non-overflowing integer type.

/* Patched code in PyMongo version 4.18.2 */
static int buffer_assure_space(buffer_t buffer, int size) {
    long long new_size;
    
    /* Explicitly check and reject negative sizes */
    if (size < 0) {
        PyErr_SetString(PyExc_ValueError,
                        "Document would overflow BSON size limit");
        return 1;
    }
 
    /* Perform calculation in a 64-bit container to prevent signed overflow */
    new_size = (long long)buffer->position + (long long)size;
    
    /* Validate the 64-bit result directly against 32-bit INT_MAX limits */
    if (new_size > INT_MAX) {
        PyErr_SetString(PyExc_ValueError,
                        "Document would overflow BSON size limit");
        return 1;
    }
 
    if ((int)new_size <= buffer->size) {
        return 0;
    }
    return buffer_grow(buffer, (int)new_size);
}

Upcasting the operands to long long guarantees the addition will not overflow the machine register. The explicit check against INT_MAX ensures that the subsequent downcast back to a 32-bit int is mathematically safe. This approach prevents compilers from optimizing away the boundary verification checks.

To exploit this vulnerability, an attacker must trigger an execution path where the PyMongo client driver serializes an exceptionally large document exceeding 2GiB in size. This requirement makes the vulnerability most exploitable on 64-bit operating systems where the Python interpreter can allocate massive objects in system memory.

The attacker crafts and transmits structured input (such as nested dictionary structures or long string values) to an endpoint that passes the payload directly to PyMongo serialization functions (e.g., bson.encode or database insert commands). The PyMongo C extension loops over the elements, sequentially calling buffer_assure_space.

As the size parameter overflows the signed 32-bit boundary, the compiler-optimized binary skips the heap-allocation check and returns success. When the native driver attempts to copy data, the memory operations write past the limits of the allocated buffer, corrupting adjacent heap structures, allocator metadata, or Python heap pointers. This sequence of events is illustrated below:

A successful heap out-of-bounds write can result in immediate system instability or arbitrary code execution. The primary impact is denial of service (DoS) due to memory violations. When the application writes outside the heap bounds, it corrupts critical heap metadata, resulting in an unrecoverable segmentation fault.

Under specific memory layout conditions, an attacker can overwrite adjacent heap structures, such as Python object pointers or standard allocator headers. By carefully structuring the payload to place shellcode addresses in overwritten function pointers, an attacker can potentially hijack application execution flow.

While CVSS assigns a Local (L) attack vector, any remote-facing application that accepts and serializes user-supplied document structures without size restrictions elevates this vulnerability to an unauthenticated remote execution vector. The threat level is significant for large-scale data processing systems and database pipelines.

The definitive remediation is upgrading PyMongo to version 4.18.2 or higher. The updated package implements proper integer upcasting and explicitly checks limits against INT_MAX inside bson/buffer.c.

If upgrading is not immediately possible, organizations can apply a software workaround by disabling PyMongo's native C extensions. Setting the environment variable PYTHON_BSON_EXTENSIONS=0 forces PyMongo to use its pure-Python implementation of BSON serialization, which is immune to buffer overflows due to Python's arbitrary-precision integers.

Additionally, applications should implement strict input size validation. Because MongoDB natively enforces a 16MB document size limit, applications should reject any payloads approaching this limit at the API gateway layer before they reach the database driver. This configuration reduces risk and protects against resource depletion.