MongoDB C Driver CVE-2026-120956

The embedding application must initiate a connection and run a query against an attacker-controlled, compromised, or impersonated MongoDB endpoint; no credentials are required (PR:N), but the client must actively connect and query it (UI:P passive interaction), and the attacker must be positioned to serve the crafted response (rogue server, attacker-supplied connection target, or man-in-the-middle). The exact trigger beyond 'a malformed/mis-typed namespace field in a query response' is not further detailed in the available sources. Limiting factors: impact is confined to the single process embedding the driver (no scope change, SC/SI/SA:N); clients that only ever connect to trusted, controlled clusters are not realistically exposed. No fixed version is stated in the available data.

This is a moderate-severity, context-dependent flaw rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H, score 7.1) shows no authentication is required (PR:N) and low attack complexity, but exploitation is gated by the passive user-interaction requirement (UI:P): the victim client must actually connect to and query an attacker-controlled or compromised MongoDB endpoint. The dominant impact is availability (VA:H - the embedding process terminates) with only a low confidentiality impact (VC:L - a small amount of uninitialized heap is leaked back to the endpoint); there is no integrity impact. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency triage. No CISA KEV listing and no EPSS score are present in the input, and the only reference is a MongoDB Jira tracking ticket (CDRIVER-6501), not working exploit code - so there is no public exploit identified at time of analysis. The practical risk is bounded: an attacker must first get the client to talk to a hostile server, which is realistic for apps that accept user-supplied connection strings, perform discovery, or operate on untrusted networks, but not for clients that only ever reach a trusted, authenticated cluster.

An attacker who controls or impersonates a MongoDB endpoint (for example via an application that accepts a user-supplied connection URI, a rogue/replaced server, or a man-in-the-middle position) returns a malformed namespace field in a query response. When the victim client parses it, the driver reads memory outside an allocated buffer, crashing the embedding process and leaking a small amount of its uninitialized heap back to the attacker in a follow-up command. No credentials are required, but the client must connect to the hostile endpoint; no public exploit identified at time of analysis.