{"id":"CVE-2026-120684","title":"MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password","summary":"A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-908"],"vendor":"MongoDB","product":"C Driver","affected":["c_driver >= 1.25.0 <= 1.30.14","c_driver >= 2.0.0 <= 2.5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T20:10:55.996365Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T20:11:10.303Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120684","references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-6508"}],"tags":["cve.org"],"epss":0.00322,"epssPercentile":0.2532,"ingestedAt":"2026-11-05T20:33:06.431Z","slug":"CVE-2026-120684","body":"## Overview\n\nA memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.\n\n## Affected\n\n- `c_driver >= 1.25.0 <= 1.30.14`\n- `c_driver >= 2.0.0 <= 2.5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}