{"action":"Upgrade mongodb/mongodb-extension to 1.21.2 or later.","affected":[{"fixed":"1.21.2","introduced":"0"}],"component":"mongodb/mongodb-extension","cve_ids":["CVE-2025-12119"],"ecosystem":"Packagist","epss":0.00212,"exploited":false,"fixed_versions":["1.21.2"],"ghsa_id":"GHSA-mwcc-7vpp-xmv9","id":"tcs_01M5KF5WRVAFRVV17X00Q023VG","modified_at":"2026-03-24T14:46:39.905693Z","published_at":"2025-11-19T00:31:24Z","references":["https://osv.dev/vulnerability/GHSA-mwcc-7vpp-xmv9","https://nvd.nist.gov/vuln/detail/CVE-2025-12119","https://github.com/mongodb/mongo-c-driver/commit/775998df7c67","https://github.com/mongodb/mongo-php-driver/commit/fa5b43366407bc0e5b0a919ed374decd9022b2f9","https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6","https://github.com/mongodb/mongo-c-driver/releases/tag/2.1.2","https://github.com/mongodb/mongo-php-driver","https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.2","https://jira.mongodb.org/browse/PHPC-2637","https://lists.debian.org/debian-lts-announce/2026/01/msg00009.html"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-mwcc-7vpp-xmv9","url":"https://osv.dev/vulnerability/GHSA-mwcc-7vpp-xmv9"}],"summary":"MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory"}