MongoDB C Driver EUVD-2026-108307

Exploitation requires all of: a MongoDB C Driver client build compiled with the Windows-native authentication backend (SSPI); use of the Kerberos/GSSAPI authentication mechanism; and a party able to control the client-side connection configuration so as to supply an excessively long credential (username) value that drives the 32-bit integer wraparound. Limiting factors that reduce real-world risk: the vector is local/configuration-based (AV:L), not remotely reachable; the native-auth Windows build is a non-default, platform-specific deployment; high privilege over the client configuration is required (PR:H); and the trigger has high complexity with a present attack requirement (AC:H/AT:P). The primary outcome is memory corruption and denial of service of the client application itself, not the MongoDB server.

This is a moderate-severity, low-urgency issue - not a priority emergency. The MongoDB-assigned CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/UI:N, score 5.7) describes a locally-triggered flaw with high attack complexity, a present attack requirement, and high privileges required: the attacker must already control the client's connection configuration. The dominant impact is availability (VA:H) - a crash/DoS of the client application - with only low confidentiality/integrity impact from memory corruption; no scope change. There is NO CISA KEV listing, NO EPSS score supplied, and NO public exploit identified at time of analysis (the three references are release notes and the CDRIVER-6421 tracker, not proof-of-concept code). The vuln.today decision label is 'this_month', consistent with a patch-when-convenient posture rather than act_now. These signals are internally consistent: a config-dependent, Windows-only, integer-overflow DoS that an attacker who already controls client configuration could trigger - a narrow threat model where the attacker influence needed (control of connection credentials) is itself a significant precondition. Note the self-DoS character: the party supplying the oversized credential is the party whose own client process crashes, which further limits real-world adversarial value.

A MongoDB C Driver client on Windows is built with the native (SSPI) Kerberos/GSSAPI authentication backend and uses connection configuration whose credential values are influenced by an untrusted or attacker-controlled source. That party supplies an excessively long credential value, causing a 32-bit integer wraparound that allocates an undersized heap buffer; the driver then writes past the buffer, corrupting memory and crashing the client application (DoS). No public exploit code has been identified.