MongoDB C Driver CVE-2026-88035

Two non-default conditions must simultaneously be satisfied: (1) the MongoDB C Driver must have been built with the optional external SASL authentication backend compiled in - this is not a default build option; and (2) the targeted connection must be configured to use SASL authentication specifically. Additionally, the attacker must be able to supply or meaningfully influence the username value presented to the driver's connection settings (mapped as PR:L in CVSS). Limiting factors: applications using default MongoDB authentication mechanisms (SCRAM-SHA-1/256) are entirely unaffected; the impact is availability-only with no data exposure; and the exploit requires local or application-layer access to connection settings rather than raw network access.

The CVSS 4.0 score of 5.7 (AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H) appropriately reflects the bounded real-world risk. The AT:P metric captures a critical double precondition: the SASL backend must be compiled in and the specific connection must be configured to use it, materially reducing the exposed population. AV:L and PR:L confirm that the attacker must already have some degree of influence over the application's connection settings - an attacker in that position may already hold significant access. The impact is purely a denial-of-service (application crash); no confidentiality or integrity compromise is indicated. There is no CISA KEV listing and no public exploit code, placing this firmly in the low-active-exploitation tier. The primary realistic concern is in multi-tenant or user-configurable environments where untrusted parties can supply database connection parameters.

In a multi-tenant application where users can partially control their database connection credentials, an attacker crafts an abnormally long username value and supplies it to the application. If the application embeds a MongoDB C Driver build that includes the external SASL backend and the connection is configured for SASL, the integer size check wraps around, the username overwrites past the buffer boundary, corrupts memory, and crashes the host application process - causing a denial-of-service for all users sharing that process.