EUVD-2026-82435
GHSA-x65h-hw7w-mq6w
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector but requires MITM/rogue-endpoint positioning (AC:H); pre-authentication processing gives PR:N/UI:N; heap OOB write yields full C/I/A with no scope change.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to, or an attacker able to impersonate or redirect the client's connection, can cause the driver to write attacker-supplied data outside the bounds of a heap allocation while processing incoming encrypted traffic. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Successful exploitation may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.
Articles & Coverage 2
AnalysisAI
Heap-based buffer overflow in the TLS transport layer of the MongoDB C Driver on Windows TLS-backend builds allows the endpoint a client connects to - or an attacker able to impersonate, redirect, or man-in-the-middle that connection - to write attacker-supplied data outside the bounds of a heap allocation while the driver processes incoming encrypted traffic, causing memory corruption, disclosure of adjacent heap memory, or termination of the client process. The flaw is reachable before any application-level authentication completes, so no credentials or user interaction are needed (CVSS PR:N/UI:N), and the vendor rates it 9.2 under CVSS 4.0; however, our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the real gating factors - this is a client-side defect that only fires when the driver connects to an attacker-controlled endpoint or when the attacker can intercept or redirect the connection (AC:H, AT:P), and only in builds compiled against the Windows platform TLS backend. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only when the MongoDB C Driver is built with the Windows platform (Secure Channel/SChannel) TLS backend - builds using OpenSSL or other backends are not affected per the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The headline CVSS 4.0 base score of 9.2 (critical) is real but must be read against its own vector: AV:N with PR:N/UI:N (pre-authentication, network-reachable) is offset by AC:H and AT:P, which encode the key limiting fact - this is a CLIENT-side flaw that only triggers when the MongoDB C Driver connects to an endpoint the attacker controls, or when the attacker can MITM/redirect the client's connection. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed version is specified in the available intelligence; the authoritative fix status and any patched release is tracked in the MongoDB issue https://jira.mongodb.org/browse/CDRIVER-6417, so the first step is to monitor that issue and EI (EUVD-2026-82435) and upgrade to the first release MongoDB marks as fixed for each affected branch (1.24.x, 1.25.x, 1.26.x, 1.27.x, 1.28.x, 1.29.x, 1.30.x, 2.0.x-2.4.x). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and services using the MongoDB C Driver on Windows and determine if they are compiled with the Windows TLS backend; immediately restrict outbound TLS connections to only trusted, verified MongoDB endpoints and enable strict certificate validation and hostname verification. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today