MongoDB libmongocrypt EUVD-2026-95160

Exploitation requires one of two concrete paths: (1) an authenticated user with write privileges to the key vault collection modifies a data key document so it carries a malformed KMS endpoint, or (2) the application passes a KMS endpoint containing a colon after its path or query component to libmongocrypt during key creation. Limiting factors: the attacker must either hold authenticated write access to the key vault (PR:L) or control the KMS endpoint string the application supplies, and the affected product must actually use libmongocrypt (i.e., MongoDB client-side field level encryption / queryable encryption must be enabled). Impact is limited to crashing the application process - no code execution, data disclosure, or data tampering results.

This is a denial-of-service vulnerability, not a memory-corruption or data-exposure issue - the description explicitly states it 'does not access memory outside its allocated bounds,' and the CVSS 4.0 vector confirms this with VC:N/VI:N and only VA:H (availability high). The vector CVSS:4.0/AV:N/AC:L/PR:L/UI:N indicates a network-reachable, low-complexity attack requiring low privileges (PR:L) and no user interaction, yielding a 7.1 (High) score driven solely by availability loss. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so exploitation likelihood cannot be quantified from the data - this appears to be a vendor-reported hardening fix (MongoDB JIRA MONGOCRYPT-986) rather than an actively exploited flaw. Realistic priority is moderate: the impact ceiling is a crashed application process, and exploitation requires either an authenticated user with write access to the key vault collection or an application that forwards untrusted KMS endpoints during key creation. The 'Information Disclosure' tag conflicts directly with the CVSS vector (VC:N) and the description - treat this as a DoS, not a confidentiality issue.

An authenticated user with write access to the MongoDB key vault collection modifies a data key document to contain a malformed KMS endpoint (e.g., one with a colon placed after the path or query component), or an application accepts such an endpoint string during key creation. When libmongocrypt parses the endpoint, an integer underflow produces a bogus allocation size, the allocation fails, and the host application process terminates. No public exploit code was identified in the provided data, but the trigger condition is simple and does not require user interaction.