MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory

BAJO 3.3CVE-2025-12119 · GHSA-mwcc-7vpp-xmv9 · Published 18/11/2025 · updated 07/10/2026

En resumen

CVE-2025-12119 es una vulnerabilidad BAJO (CVSS 3.3) que afecta a mongodb/mongodb-extension, c driver (mongodb), php driver (mongodb).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.21%, mayor que el 11.5% de las vulnerabilidades.
Solución: actualizar a 1.21.2, 1.30.6, 2.1.2 o posterior.

Package	Affected versions	Patched versions
mongodb/mongodb-extension Packagist	`< 1.21.2`	`1.21.2`
c driver mongodb	`≥ 1.9.0, < 1.30.6≥ 2.0.0, < 2.1.2`	`1.30.62.1.2`
php driver mongodb	`< 1.21.2`	`1.21.2`

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

NVD description

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.