Memory corruption via signed index overflow

Integer overflow in MongoDB libbson before 1.26.2 allows attackers to corrupt process memory through bson_strfreev array cleanup. The function traverses a NULL-terminated string array with a signed integer index, which can wrap negative and pass an invalid element pointer to bson_free. Reachability requires a consuming application to invoke bson_strfreev on an attacker-influenced array long enough to overflow the index; libbson exposes no network service itself.