MongoDB C Driver EUVD-2026-95144

Exploitation requires the attacker to supply the SCRAM server-final message before server-signature verification - meaning the attacker must operate the MongoDB server the client connects to, or sit as a network intermediary (MITM) within the authentication handshake. The client application must be using the MongoDB C Driver with SCRAM authentication. Limiting factors: the attacker cannot trigger this against a client talking to a legitimate, trusted server without MITM positioning (reflected as AT:P), the impact is confined to process termination (denial of service) with no data exposure, and no privileges or user interaction on the client are needed (PR:N/UI:N).

This is a medium-severity denial-of-service issue, not a high-priority emergency. The MongoDB-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 with availability-only impact (VA:L) and no confidentiality or integrity impact - consistent with the description, which explicitly states the out-of-bounds byte 'is not returned through the protocol,' so despite the 'Information Disclosure' tag there is NO actual data leak; the real impact is a crash of the application using the driver. The critical qualifier is AT:P (Attack Requirements: Present): exploitation requires the attacker to act as the MongoDB server endpoint or a network intermediary (MITM) able to inject the malformed server-final message before server-signature verification completes - this is NOT a flaw a random remote attacker can trigger against a client connecting to a trusted server. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. Net assessment: a legitimate bug worth patching on a normal cycle, but the positioning precondition plus DoS-only impact keep real-world risk modest rather than urgent.

An attacker who controls a malicious MongoDB server endpoint, or who can intercept traffic as a network intermediary during the SCRAM authentication handshake, sends a crafted malformed server-final message to a client built on the MongoDB C Driver. The driver reads one byte past a fixed-size buffer while parsing it, terminating the client application and causing denial of service. No public exploit was identified in the provided data, and the network vector is tempered by the requirement to be positioned in the authentication exchange (AT:P).