Vulnerability in MongoDB C Driver

[ Description ]Official description

A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4328

  MongoDB (EF Core Provider, Atlas SQL, C Treiber, Rust Treiber, Database Tools and Node.js Treiber): Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-119672CVE-2026-120954CVE-2026-120678+12 more CVEs

[ References ]References

• jira.mongodb.org/browse/CDRIVER-6508