EUVD-2026-31132
GHSA-87jr-c2qj-3qrg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).
AnalysisAI
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabling crafted documents stored in a GridFS collection to trigger either a division-by-zero crash (denial of service) or an out-of-bounds read that exposes process memory contents to the caller. Versions in the 1.x branch before 1.30.8 and 2.x branch before 2.2.4 are affected per EUVD-2026-31132. The CVSS 4.0 score of 6.0 accurately reflects a constrained attack path requiring low-privilege database access and a pre-positioned malicious document (AT:P), with no public exploit identified at time of analysis.
Technical ContextAI
The MongoDB C Driver (CPE: cpe:2.3:a:mongodb,_inc.:c_driver:*:*:*:*:*:*:*:*) is the official C-language client library used directly by applications and as an underlying component of higher-level MongoDB drivers. Its legacy GridFS API reads file metadata documents - including fields such as chunkSize and length - from the fs.files collection and uses them in arithmetic operations and memory offset calculations without adequate input validation. CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input) precisely describes the root cause: when the driver consumes a chunkSize value of zero, a downstream division operation produces a divide-by-zero fault, crashing the process. When a malformed length or offset field is accepted, the driver performs an out-of-bounds read, potentially returning arbitrary heap or stack memory contents to the application. The 'Buffer Overflow' tag attached to this CVE is a coarse automated classification; the actual mechanics are better characterised as improper offset validation leading to a read primitive rather than a classic write overflow.
RemediationAI
The primary remediation is to upgrade the MongoDB C Driver to version 1.30.8 or later for 1.x branch deployments, or to version 2.2.4 or later for 2.x branch deployments; the vendor-released patch is confirmed available per the reporter (MongoDB) and tracked at https://jira.mongodb.org/browse/CDRIVER-6281. Where immediate upgrade is not feasible, restrict write access to the fs.files and fs.chunks GridFS collections to only fully trusted application service accounts using MongoDB role-based access control - this raises the bar for an attacker to pre-position malformed documents, though it does not eliminate risk if any trusted application path can introduce externally-supplied metadata. As an additional compensating control, if the application does not strictly require the legacy GridFS API, migrating to the non-legacy GridFS implementation removes the vulnerable code path entirely, though this requires application-level changes and regression testing. Applications that do not use GridFS at all should confirm they are not linking against the legacy API surface to eliminate exposure. Note that restricting collection-level write permissions has the trade-off of potentially breaking application workflows that rely on direct GridFS document insertion.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress s
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthentica
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are
Heap buffer out-of-bounds write in the MongoDB C Driver's BSON-to-JSON conversion helpers allows an unauthenticated part
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cau
GridFS NoSQL injection in the MongoDB C Driver (libmongoc) enables authenticated users with influence over file identifi
Numeric truncation in the MongoDB C++ Driver's BSON library JSON parsing interface allows an attacker who controls text
Integer wraparound in the MongoDB C Driver BSON library's JSON parser allows an unauthenticated party supplying a suffic
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today