{"id":"CVE-2026-120955","title":"MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata","summary":"The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-476"],"vendor":"MongoDB","product":"C Driver","affected":["c_driver >= 1.25.0 <= 1.30.14","c_driver >= 2.0.0 <= 2.5.7"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-03T20:00:00.676711Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T20:00:13.969Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120955","references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-6494"}],"tags":["cve.org"],"epss":0.00359,"epssPercentile":0.29852,"ingestedAt":"2026-11-05T20:33:06.426Z","slug":"CVE-2026-120955","body":"## Overview\n\nThe GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.\n\n## Affected\n\n- `c_driver >= 1.25.0 <= 1.30.14`\n- `c_driver >= 2.0.0 <= 2.5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}