Read the docs
TI-2026-69711 Aliases CVE-2026-106433

Memory corruption in MongoDB libmongocrypt with duplicate masterKey

Priority LOW 39CWE-843Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-843 and the CVSS impact.

Summary

MongoDB libmongocrypt from 1.1.0 before 1.20.5 is affected. Improper state management treats provider-specific data as an incompatible type (CWE-843) when cleaning up a key document with duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server returning such a document, can cause invalid memory access and frees in the client. This can terminate the application or corrupt process memory.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 17th percentileScored 2026-11-07
Fix Fixed libmongocrypt (MongoDB): 1.20.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBlibmongocrypt1.1.0 to before 1.20.51.20.5Patch availableCNA
  • libmongocrypt VendorMongoDB Affected 1.1.0 to before 1.20.5 Fixed in 1.20.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:libmongocrypt:*:*:*:*:*:*:*:*1.5.0 to before 1.20.5VulnerableMongoDB
  • cpe:2.3:a:mongodb:libmongocrypt:*:*:*:*:*:*:*:* Versions 1.5.0 to before 1.20.5 Vulnerable ·MongoDB

Remediation

MongoDB libmongocrypt is fixed in version 1.20.5.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA libmongocrypt (MongoDB) Fixed in 1.20.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MongoDB libmongocrypt 1.20.5

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-69708 Denial of service in MongoDB libmongocrypt via malformed KMS endpointPriority LOW 31
    • TI-2026-69712 Unrecognized payload accepted as plaintext in libmongocrypt decryptionPriority LOW 23
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-106433
  2. 2026-10-10 Affected versions changed · Red Hat
  3. 2026-10-10 CVSS score added · Red Hat

References

Advisory 1

  • TI-2026-58394 Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path CVSS 4.0HIGH 7.1
  • TI-2026-58385 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings CVSS 4.0MEDIUM 5.7
  • TI-2026-56244 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt CVSS 4.0LOW 2.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences