CVE-2026-120684 | BDVDB-2026-399673 Detail

Description#

A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-03Record published in the CVE List.