MongoDB C Driver CVE-2026-120955

The affected application must use the MongoDB C Driver's GridFS file download API and must allow an attacker to influence the file download parameters, so that retrieval can be driven into the specific error condition where an internal operation result is not checked, producing the NULL pointer dereference while stream operations continue. Limiting factors: exploitation depends on the application exposing this API with untrusted-controlled download parameters; applications that do not use GridFS downloads, or that do not pass externally-influenced parameters to it, are not reachable. The precise internal operation and error condition that must occur are not detailed beyond 'certain error conditions during file retrieval' in the available sources. Impact is confined to availability (process termination); no confidentiality or integrity effect is indicated.

This is a genuine availability risk but not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger with a single impact dimension: VA:H (high availability), while VC/VI are N - confirming a pure denial-of-service NULL pointer dereference (CWE-476) with no confidentiality or integrity consequence. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a DoS-only crash. No EPSS score, no CISA KEV listing, and no confirmed exploit code were provided, so there is no public evidence of active exploitation or widespread weaponization; the only reference is the vendor's own Jira tracking ticket (CDRIVER-6494). An important caveat: although the CVSS marks PR:N, the description says 'a user who can influence file download parameters' can trigger it - exploitability is therefore mediated by whether the hosting application exposes the GridFS download API to untrusted parameter input, which the raw CVSS network/unauthenticated rating does not capture. Net: prioritize patching within normal cycles (this week), but this is an availability-only issue rather than a code-execution or data-exposure crisis.

An application built on the MongoDB C Driver exposes GridFS file downloads where a client can influence the download parameters (e.g., file identifier or retrieval options). An attacker supplies parameters that drive the retrieval into the specific error condition where an internal operation's result is left unchecked, causing a NULL pointer dereference as stream operations continue; the process crashes, taking down the service. No public exploit code was identified at time of analysis; the only reference is the vendor Jira ticket.