High severity8.1OSV Advisory· Published Sep 10, 2018· Updated Jun 17, 2026

CVE-2018-16790

Description

_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

MongoDB/C DriverOSV2 versions
0.90.0, 0.92.0, 0.92.2, …+ 1 more
- (no CPE)range: 0.90.0, 0.92.0, 0.92.2, …
- (no CPE)range: = 1.12.0
MongoDB/Libbsonllm-fuzzy
Range: = 1.12.0

Patches

Vulnerability mechanics

References

github.com/mongodb/mongo-c-driver/commit/0d9a4d98bfdf4acd2c0138d4aaeb4e2e0934bd84nvdPatch
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
jira.mongodb.org/browse/CDRIVER-2819nvdIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2025/05/msg00012.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000