CVE-2026-114645 in C Driver
Summary
by MITRE • 10/22/2026
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Windows-native authentication backend.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified involves a critical integer wraparound flaw within the MongoDB C Driver, specifically affecting its Kerberos and SSPI authentication mechanisms on Microsoft Windows platforms. This security defect arises during the processing of credential values provided in the client's connection configuration. When an attacker or misconfigured application supplies an excessively long credential string, the driver fails to properly validate the length before performing arithmetic operations related to memory allocation. Specifically, a 32-bit integer overflow occurs when calculating the required buffer size for storing these credentials. Because the calculation wraps around due to exceeding the maximum value representable by a signed or unsigned 32-bit integer, the resulting allocated heap buffer is significantly smaller than what is actually needed to hold the input data.
This memory management error leads directly to a classic out-of-bounds write condition. Once the undersized buffer is allocated on the heap, subsequent operations attempt to copy the full length of the provided credential value into this insufficiently sized space. Consequently, data written beyond the end of the allocated block corrupts adjacent memory regions on the heap. This corruption can overwrite critical metadata structures used by the memory allocator or other application variables stored nearby in memory. The immediate operational impact is often a crash of the client process due to access violations triggered when the corrupted memory is accessed later during program execution, resulting in a denial of service for the affected MongoDB client applications.
Beyond simple instability, heap corruption vulnerabilities like this pose severe security risks if an attacker can exert precise control over the input data and the surrounding memory layout. While the primary reported impact is denial of service through application crashes, out-of-bounds writes are frequently precursors to arbitrary code execution. An sophisticated adversary might leverage such a flaw to manipulate function pointers or exception handling structures within the corrupted heap region, potentially achieving remote code execution on the client machine where the vulnerable driver is running. However, exploitation requires that the attacker controls the client-side configuration parameters passed to the MongoDB C Driver during connection setup, which limits the attack surface primarily to scenarios involving untrusted input in application configurations or compromised local environments controlling the client process.
From a classification perspective, this vulnerability aligns with CWE-190, Integer Overflow or Wraparound, as the root cause is the failure of arithmetic operations to handle large inputs correctly. The resulting memory corruption falls under CWE-787, Out-of-bounds Write, which describes writing data outside the bounds of an allocated buffer. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw could be categorized under T1203, Exploitation for Client Execution, if leveraged to compromise a client system through malicious configuration inputs or application behavior manipulation. It is important to note that this issue is specific to builds compiled with the Windows-native authentication backend and does not affect other platforms or authentication methods supported by the driver.
Mitigation strategies must focus on updating the MongoDB C Driver to versions where this integer overflow has been patched with proper bounds checking before memory allocation occurs. Developers utilizing the affected library should ensure they are running a version that includes fixes for CVE-related heap corruption issues in their Windows-specific builds. Additionally, application developers integrating the driver should implement strict input validation and length limits on all credential values passed to connection configuration structures, treating any external or user-supplied data as untrusted regardless of its source. Regular security audits of code paths handling authentication parameters can help identify similar integer arithmetic vulnerabilities before they are exploited in production environments.