CVE-2026-106433

HighCVSS 8.8

Published: 08/10/2026(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process.

Risk Assessment

This can terminate the application or corrupt process memory, leading to crashes or data integrity compromise.

Recommendation

Update libmongocrypt to the latest patched version. Restrict access to key vault documents and monitor their integrity.

Other vulnerabilities in libmongocrypt

CVE-2026-114655Medium
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS