CVE-2026-9100 - Heap memory out of bounds read and crash in C Driver legacy GridFS file reader · CoreCVE

Back Back to CVE browser

MEDIUM

Heap memory out of bounds read and crash in C Driver legacy GridFS file reader

Published May 20, 2026

6.0

MEDIUM

CVSS 4.0

EPSS 0.30%

Description

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

Affected products

Vendor MongoDB, Inc. Product C Driver Default
unaffected
Affected
- ≥ 1.0, < 1.30.8
- ≥ 2.0, < 2.2.4

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
MongoDB, Inc.	C Driver	unaffected	Affected ≥ 1.0, < 1.30.8 ≥ 2.0, < 2.2.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1285

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31132
Advisory
https://jira.mongodb.org/browse/CDRIVER-6281
issue-tracking

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31132		Advisory
https://jira.mongodb.org/browse/CDRIVER-6281		issue-tracking

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mongodb

Published May 20, 2026

Updated May 20, 2026

Reserved May 20, 2026

Link CVE-2026-9100

CISA Vulnrichment

Updated May 20, 2026

NVD

Status Undergoing Analysis

Modified Jul 23, 2026

Link CVE-2026-9100

Red Hat

No data

ENISA EUVD

Assigner mongodb

Published May 20, 2026

Updated May 20, 2026

Link EUVD-2026-31132

GitHub

No data