CVE-2026-114645: falha de média gravidade em MongoDB C Driver
Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.7epss 0.2%
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Windows-native authentication backend.
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
MongoDB · C DriverCVEs relacionadas — MongoDB C Driver
No mesmo produto, das mais perigosas para as menos.
CVE-2026-96746HIGHHeap buffer overflow via mid-scan command list growth in client topology monitoringEPSS 0.4%CVE-2026-120678HIGHMongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)EPSS 0.4%CVE-2026-120955HIGHMongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS MetadataEPSS 0.4%CVE-2026-120684MEDIUMMongoDB C Driver GridFS gap lets a shared writer recover a protected client's passwordEPSS 0.3%CVE-2026-84963MEDIUMSilent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parserEPSS 0.3%CVE-2026-84969MEDIUMHeap overflow via truncated base64 encoding of binary fields in length-limited JSON outputEPSS 0.3%