MongoDB C Driver CVE-2026-9100

Exploitation requires all of the following specific conditions to be satisfied simultaneously. First, the target application must use the MongoDB C Driver's legacy GridFS API to read files - applications using alternative GridFS implementations or not using GridFS functionality are entirely unaffected. Second, the attacker must possess low-privilege authenticated database access sufficient to write documents to the GridFS fs.files collection (consistent with PR:L in the CVSS vector); this could be a direct database credential or an indirect path through a writable application endpoint that stores user-supplied data into GridFS. Third, AT:P (Attack Requirements: Present) in the CVSS 4.0 vector confirms that a pre-positioned malformed document must already exist in the collection at the time the vulnerable application reads it - the attacker cannot trigger the flaw in a single unauthenticated network request. Exploitation is limited by the authentication prerequisite (PR:L), the requirement to control or influence GridFS collection contents, and the scoping of the confidentiality impact to process memory (VC:L) rather than arbitrary storage or cross-scope data. Environments where GridFS collections are only writable by the application's own privileged service account and not accessible to external users or lower-trust tenants have substantially reduced exposure.

The CVSS 4.0 score of 6.0 (AV:N/AC:L/AT:P/PR:L/UI:N, VC:L/VI:N/VA:H) reflects a nuanced risk picture. Network reachability (AV:N) and low complexity (AC:L) broaden the potential attacker pool, but the attack requirement (AT:P) is a meaningful constraint: a malformed document must already be resident in the target GridFS collection before the vulnerable read path is triggered. Low-privilege authentication (PR:L) is additionally required, meaning unauthenticated exploitation is not supported by the CVSS vector. The dual impact profile is the most operationally significant signal: VA:H indicates a reliable crash vector (division-by-zero is deterministic), while VC:L reflects a bounded but real memory disclosure risk. No EPSS score was provided in the input data, so quantitative exploitation probability cannot be cited. This CVE is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, consistent with a researcher-reported, vendor-confirmed vulnerability without observed in-the-wild abuse. In multi-tenant or shared MongoDB deployments - where one tenant can write to collections that a privileged application process subsequently reads - the AT:P precondition is substantially easier to satisfy, elevating practical risk above what the base score alone suggests.

An attacker with low-privilege write access to a MongoDB instance - such as a compromised application service account or a malicious tenant in a shared deployment - inserts a crafted document into the fs.files collection with a chunkSize field set to zero and a malformed length value. When the legitimate application subsequently reads that file using the MongoDB C Driver's legacy GridFS API, the driver consumes the unvalidated metadata and either divides by the zero chunkSize (crashing the process and producing a denial of service) or performs an out-of-bounds memory read using the malformed length, returning heap memory contents that may include sensitive in-process data such as connection strings, session tokens, or other application secrets. No public proof-of-concept code has been identified at time of analysis.