CVE-2026-96749: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-96749 is a heap out-of-bounds write vulnerability caused by a signed integer overflow in the BSON document encoding component of the MongoDB Python Driver (PyMongo). When a single BSON document is constructed from an unusually large amount of caller-supplied data, size arithmetic performed in a signed 32-bit type can overflow, and the overflow guard relies on undefined behavior per the C language standard, potentially allowing a write outside the bounds of an allocated heap buffer. The vulnerability affects PyMongo versions 1.9.0 through 4.18.1 (all versions before 4.18.2) and was disclosed on September 24, 2026. It carries a CVSS v3.1 base score of 8.4 (High) and a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory, GitHub Release).

The root cause is classified as CWE-190 (Integer Overflow or Wraparound), specifically a signed 32-bit integer overflow in the native C extension bundled with PyMongo that handles BSON document encoding. During document size calculation, the arithmetic wraps around when the accumulated data size exceeds the maximum value of a signed 32-bit integer (~2 GB), and the guard condition intended to detect this overflow invokes undefined behavior under the C standard — meaning the compiler may optimize it away entirely. This allows a subsequent heap buffer write to occur at an out-of-bounds memory location within the application's own process. Exploitation requires the attacker to control data that the application encodes into a BSON document, and the actual exploitability depends on how the native C extension was compiled (e.g., optimization level and compiler behavior) (GitHub Advisory, GitHub Changelog).

Successful exploitation can result in a heap out-of-bounds write within the affected application's process, with potential high impact to confidentiality, integrity, and availability of the vulnerable system. Depending on memory layout and application context, an attacker who can supply sufficiently large data for BSON encoding could cause application crashes (denial of service), corrupt in-process data, or potentially achieve arbitrary code execution within the application's process space. The vulnerability does not affect subsequent or external systems directly, but compromise of the application process could expose sensitive data handled by that process or enable further lateral movement (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). No threat actor attribution has been reported. The EPSS score is approximately 0.132%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to be able to supply very large data values that an application encodes into BSON, and the outcome depends on compiler-specific behavior of the native extension build.

MongoDB has released PyMongo version 4.18.2, which hardens the BSON buffer size guard against signed integer overflow, resolving this vulnerability. All users running PyMongo versions 1.9.0 through 4.18.1 should upgrade to 4.18.2 or later immediately via pip install --upgrade pymongo. As a temporary workaround where upgrading is not immediately possible, restrict local access to systems running applications that use the MongoDB Python Driver and validate or limit the size of caller-supplied data before it is encoded into BSON documents (GitHub Release, GitHub Changelog).

The vulnerability was covered by security news outlets including SecurityOnline.info and picked up by Linux distribution security teams, with SUSE issuing a security update (SUSE-SU-2026:4398-1) and openSUSE publishing a corresponding advisory. Red Hat also tracked the CVE in their security database. The German Linux security community (pro-linux.de) and AUSCERT (ESB-2026.11902) noted the issue in their security roundups. Overall community reaction has been measured, consistent with a vulnerability that has no known active exploitation and a clear vendor patch available.