CVE-2025-14911: Integer Overflow in GridFS chunkSize Leading to Heap Allocation Failure
Published Jan 27, 2026
·Updated
User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.
Affected Software
1 affected component
MongoDB MongoDB
Event History
Jan 27, 2026
CVE Published
via MITRE·05:29 PM
Data Sourced
via MITRE·05:29 PM
DescriptionSeverity
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-14911?
CVE-2025-14911 is considered a high-severity vulnerability due to the potential for heap allocation failures that could be exploited.
2
How do I fix CVE-2025-14911?
To fix CVE-2025-14911, ensure that you are using the latest version of MongoDB where the issue has been addressed.
3
What causes CVE-2025-14911?
CVE-2025-14911 is caused by integer overflow in the GridFS chunkSize metadata, which lacks proper validation.
4
Who is affected by CVE-2025-14911?
CVE-2025-14911 affects users of MongoDB that utilize GridFS with user-controlled chunkSize metadata.
5
What are the potential impacts of CVE-2025-14911?
The potential impacts of CVE-2025-14911 include application crashes and arbitrary code execution due to heap allocation failures.