Memory-Safety Flaw in Key Management Library by MongoDB

CVE-2026-126792

What is CVE-2026-126792?

A memory-safety flaw exists in the key-management request-building component of the MongoDB Cryptographic Library, which may allow an out-of-bounds write on the heap. The issue arises from a fixed-size output buffer, which is used without validating the actual cryptographic key size. When the library is incorporated by an application that provides its own cryptographic callback implementation, there is potential for data exceeding the buffer limits to be written beyond its end. Exploiting this vulnerability necessitates a position with privileges to control the embedding application's in-process key-management provider configuration, leading to memory corruption and causing the client process to terminate unexpectedly.

References