MongoDB Libbson vulnerabilities

3 CVEs affecting MongoDB Libbson, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0755, published 2025-03-18.

More from MongoDB.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-16790, published 2018-09-10. High severity, CVSS 8.1. EPSS: 2.1% chance of exploitation in the next 30 days. _bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer.
• CVE-2025-0755, published 2025-03-18. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum…
• CVE-2024-6381, published 2024-07-02. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory…