AIKIDO-2026-506971

TL;DR

PyMongo's bundled native BSON encoder computes buffer growth size in a signed 32-bit int and uses an overflow check with undefined behavior in C. Encoding a single document built from a very large amount of caller supplied data can overflow that signed arithmetic, so the encoder writes outside the allocated buffer, causing a heap out-of-bounds write in the application's process. An unprivileged party who can place a very large value into data that an application encodes can trigger this, depending on how the native extension was built. The fix computes the size in a wider type and rejects negative or over-limit sizes before the buffer grows.