Buffer Overflow Vulnerability in MongoDB C Driver for Windows Authentication

CVE-2026-114645

What is CVE-2026-114645?

A vulnerability in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code allows for a 32-bit integer wraparound. This may lead to the allocation of an undersized heap buffer when an excessively long credential value is specified in the client's connection configuration. An attacker controlling this client-side configuration, combined with the affected authentication mechanism, can potentially cause the driver to write data outside the bounds of the allocated memory. This situation could result in memory corruption and a denial of service for the client application, impacting stability and security.

References