MongoDB C Driver: Out-of-bounds heap memory disclosure (CVE-2026-120956)
The MongoDB C Driver fails to validate server-provided namespace fields, allowing an unauthenticated malicious MongoDB endpoint to trigger a process crash or cause the driver to disclose uninitialized heap memory.
CVE search metadata
CVE search record: CVE-2026-120956. Severity: high. CVSS: 7.1. KEV: no. Product: C Driver. Brief: MongoDB C Driver: Out-of-bounds heap memory disclosure (CVE-2026-120956). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mongodb-c-driver-memory-disclosure/
Triage facts
Revision 1- Applicability
- C Driver
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 20:02 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The MongoDB C Driver lacks validation for the type and format of 'namespace' fields returned by a MongoDB server. An unauthenticated attacker-controlled MongoDB endpoint can exploit this by returning a malformed namespace value in a query response. This results in either a process termination (denial of service) or an out-of-bounds memory read, leading to the leakage of the client application's uninitialized heap memory via subsequent commands. The impact is isolated to the client application process embedding the vulnerable driver.
Impact
Confirmed impacts include process termination (Denial of Service) and the potential exposure of sensitive data stored in uninitialized heap memory to a malicious server endpoint.
Recommendation
- Inventory all internal applications and services that utilize the MongoDB C Driver.
- Prioritize updates to the driver as soon as a patch is released by MongoDB to address the lack of input validation.
- Monitor client applications for unexpected crashes or error patterns that correlate with MongoDB connectivity.
Immediate actions
Inventory applications using the MongoDB C Driver for future patching.
Threat Hunt
Identify client applications crashing during MongoDB interactions.
Data: Application error logs (e.g., SIGSEGV, Segmentation Fault, application panic logs), MongoDB client connection telemetry
Mitigations
Update the MongoDB C Driver to a patched version once released by the vendor.
CVE-2026-120956