CVE-2026-106433: Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Client applications using MongoDB libmongocrypt are exposed if an authenticated actor can modify key vault documents, or if the server can return a crafted key document containing duplicate masterKey fields.
What does an attacker need to exploit it?
The attacker needs the ability to influence a key document processed by the client, either by modifying key vault documents as an authenticated actor or by operating or influencing a server that returns the malicious document. No user interaction is required.
What is the likely impact on an affected client?
Processing the crafted key document can cause invalid memory access and invalid frees in the client process. This may terminate the application or corrupt process memory.