MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory

低危 3.3CVE-2025-12119 · GHSA-mwcc-7vpp-xmv9 · Published 18/11/2025 · updated 07/10/2026

要点

CVE-2025-12119 是影响 mongodb/mongodb-extension, c driver (mongodb), php driver (mongodb) 的低危 (CVSS 3.3)漏洞。
未来 30 天内被利用的概率（EPSS）：0.21%，高于 11.5% 的漏洞。
修复：升级到 1.21.2, 1.30.6, 2.1.2 或更高版本。

Package	Affected versions	Patched versions
mongodb/mongodb-extension Packagist	`< 1.21.2`	`1.21.2`
c driver mongodb	`≥ 1.9.0, < 1.30.6≥ 2.0.0, < 2.1.2`	`1.30.62.1.2`
php driver mongodb	`< 1.21.2`	`1.21.2`

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

NVD description

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.