Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-9100

Heap memory out of bounds read and crash in C Driver legacy GridFS file reader

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB, Inc. C Driver

Default version status: unaffected

  • 1.0 to < 1.30.8affected
  • 2.0 to < 2.2.4affected

References