CVE-2026-9100: Heap memory out of bounds read and crash in C Driver legacy GridFS file reader
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to GridFS collections to trusted clients only (for example via database access controls, network ACLs, or firewall rules) to reduce exposure to crafted GridFS metadata.
- Compensating control
Avoid reading GridFS files via the MongoDB C Driver legacy GridFS API (disable or replace usage in applications) until a fixed driver or patch is available.
- Operational
Inventory and identify all applications and services that use the MongoDB C Driver legacy GridFS API. Stop those applications from reading GridFS files using the legacy API until a remediation is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9100?
The severity of CVE-2026-9100 is critical due to the potential for remote code execution and application crash.
How do I fix CVE-2026-9100?
To fix CVE-2026-9100, upgrade to the latest version of the MongoDB C Driver where the vulnerability has been addressed.
What causes CVE-2026-9100?
CVE-2026-9100 is caused by the MongoDB C Driver's legacy GridFS API not properly validating malformed file metadata.
Which software is affected by CVE-2026-9100?
CVE-2026-9100 affects the MongoDB C Driver specifically when using the legacy GridFS file reading functionality.
What are the potential impacts of CVE-2026-9100?
The potential impacts of CVE-2026-9100 include heap memory out of bounds read and application crashes when processing crafted documents.