Heap-based buffer overflow in MongoDB driver for C - CVE-2026-114645
Published: October 25, 2026
Vulnerability details
The vulnerability allows a local privileged user to corrupt client process memory and cause a denial of service in the client application.
The vulnerability exists due to a heap-based buffer overflow caused by 32-bit integer wraparound in the MongoDB C Driver's Windows Kerberos/SSPI authentication code when wrapping authentication messages using an excessively long URI username. A local privileged user can supply an excessively long username through client-side connection configuration to cause an undersized heap allocation and subsequent out-of-bounds writes, corrupting client process memory and causing a denial of service.
Only client builds compiled with the Windows-native authentication backend are affected.