Security readout for executives and security teams
Plain-English summary
CVE-2018-16790 is a memory-safety flaw in libbson 1.12.0, used by MongoDB's C driver and other products. A crafted BSON buffer can trigger a heap buffer over-read. The source bundle does not provide a severity score or confirmed business impact.
Executive priority
Treat as a dependency hygiene issue with uncertain severity. Prioritize inventory and vendor-supported updates, especially for services processing external data.
Technical view
The issue is in _bson_iter_next_internal in bson-iter.c. When parsing a crafted BSON buffer, libbson 1.12.0 can read beyond heap-allocated memory. Sources identify mongo-c-driver usage, but affected product and fixed-version data is incomplete in the bundle.
Likely exposure
Exposure is most likely where applications or packaged software use libbson 1.12.0, directly or through mongo-c-driver, and parse untrusted BSON input.
Exploitation context
No provided source or KEV status confirms active exploitation. The described trigger is a crafted BSON buffer reaching vulnerable parsing logic, but exploitability and real-world attack paths are not established here.
Researcher notes
The bundle lacks CVSS, CWE, precise affected CPEs, and named fixed versions. The GitHub commit and MongoDB Jira are key technical references; Debian LTS suggests downstream packaging attention in 2025.
Mitigation direction
- Inventory libbson and mongo-c-driver versions in applications and packaged dependencies.
- Check MongoDB and distribution advisories for fixed package versions.
- Apply vendor or distribution updates when available.
- Reduce acceptance of untrusted BSON where business workflows allow.
- Monitor vendor trackers for additional impact or remediation details.
Validation and detection
- Confirm whether libbson 1.12.0 is present in runtime and build dependencies.
- Review SBOMs and package manifests for mongo-c-driver or bundled libbson.
- Identify services that parse external or user-supplied BSON data.
- Verify remediation against vendor or distribution advisory version guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-16790 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/mongodb/mongo-c-driver/commit/0d9a4d98bfdf4acd2c0138d4aaeb4e2e0934bd84CVE reference · x_refsource_CONFIRM
- https://bugzilla.redhat.com/show_bug.cgi?id=1627923#c3CVE reference · x_refsource_CONFIRM
- https://jira.mongodb.org/browse/CDRIVER-2819CVE reference · x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2025/05/msg00012.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.