CyberRota Analysis
AI-GeneratedA vulnerability exists in the BSON CodeWScope element accessors that allows authenticated users to exploit a missing bounds check, leading to out-of-bounds heap reads through a crafted aggregation pipeline. This can result in server crashes or the disclosure of sensitive adjacent heap memory contents. Organizations utilizing affected products should prioritize remediation to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.
Related CVEs
Other vulnerabilities affecting the same vendor(s)