BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-12-08

Assigner: MongoDB, Inc.

Description

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-11-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12119

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	c_driver	From 1.9.0 (inc) to 1.30.6 (exc)
mongodb	c_driver	From 2.0.0 (inc) to 2.1.2 (exc)
mongodb	php_driver	to 1.21.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-825	The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

Attack-Flow Graph

Executive Summary

This vulnerability involves the mongoc_bulk_operation_t component, which may read invalid memory when large options are passed to it. This can lead to unexpected behavior or potential security issues due to improper memory handling.

Impact Analysis

The vulnerability can impact you by causing the application using mongoc_bulk_operation_t to read invalid memory, which may lead to data corruption, crashes, or potential exposure of sensitive information. The CVSS score indicates a high confidentiality impact and low availability impact, meaning sensitive data could be at risk.

Hi! I’m here to help you understand CVE-2025-12119. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70