CVE-2025-0755

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-07569.1Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before CVE-2025-07574.4Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is us CVE-2025-07586.1Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by CVE-2025-07593.3IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization CVE-2025-07602.7A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encrypt CVE-2025-07628.8Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2025-07634.3The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o CVE-2025-07646.5The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of th CVE-2025-07654.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that CVE-2025-07679.8WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writer CVE-2025-07696.3PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an un CVE-2025-07819.9An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the