MongoDB C Driver up to 1.30.13/2.5.6 Kerberos Authentication out-of-bounds write

Summaryinfo

A vulnerability labeled as critical has been found in MongoDB C Driver up to 1.30.13/2.5.6. Impacted is an unknown function of the component Kerberos Authentication. Executing a manipulation can lead to out-of-bounds write. This vulnerability is handled as CVE-2026-114645. It is possible to launch the attack on the local host. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in MongoDB C Driver up to 1.30.13/2.5.6. This vulnerability affects an unknown part of the component Kerberos Authentication. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Windows-native authentication backend.

The advisory is available at jira.mongodb.org. This vulnerability was named CVE-2026-114645 since 10/21/2026. The exploitation appears to be easy. Local access is required to approach this attack. The exploitation needs additional levels of successful authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available.

Upgrading to version 1.30.14 or 2.5.7 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• C Driver

Version

• 1.30.0
• 1.30.1
• 1.30.2
• 1.30.3
• 1.30.4
• 1.30.5
• 1.30.6
• 1.30.7
• 1.30.8
• 1.30.9
• 1.30.10
• 1.30.11
• 1.30.12
• 1.30.13
• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion