MongoDB libmongocrypt EUVD-2026-95163

Exploitation requires that the application uses libmongocrypt's explicit decryption component (client-side field level encryption) AND that the attacker can modify the stored encrypted bytes before decryption - explicitly a database writer, a malicious or compromised MongoDB server, or a network intermediary able to tamper with the ciphertext in transit. The flaw only manifests for 'unrecognized' encrypted payloads, where the library returns the input unchanged rather than erroring. Limiting factors: the attacker must already hold write access or an in-path interception position (PR:L, not anonymous), impact is confined to integrity (attacker-controlled bytes treated as plaintext) with no direct confidentiality or availability loss, and applications that do not use explicit decryption are unaffected.

This is a moderate, defense-in-depth integrity flaw rather than a high-priority emergency. The MongoDB-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium) with impact limited to vulnerable-system integrity (VI:L) and explicitly no confidentiality (VC:N) or availability (VA:N) impact, which aligns with CWE-354 (Improper Validation of Integrity Check Value). PR:L indicates the attacker needs some privilege/position - the description confirms this: an actor must already be able to modify stored encrypted fields (a database writer, compromised/malicious server, or network intermediary), i.e. a meaningful foothold rather than an anonymous remote attacker. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only reference is the vendor's own Jira ticket (MONGOCRYPT-966). Signals are internally consistent (no conflict between vector and description), and the realistic risk is best characterized as a bypass of an encryption-layer integrity guarantee that could feed attacker-controlled bytes into an application - serious in specific threat models but not a mass-exploitation candidate.

An attacker who can write to or intercept stored encrypted fields (a malicious insider with database write access, a compromised MongoDB server, or a man-in-the-middle on an untrusted link) substitutes an unrecognized/crafted encrypted payload. When the application calls libmongocrypt's explicit decryption, the library returns the supplied bytes unchanged instead of raising a decryption error, so the application treats attacker-controlled data as trusted decrypted plaintext. No public exploit code was identified at time of analysis.