{"id":"CVE-2026-120956","title":"remote abort and memory disclosure from a malformed cursor.ns","summary":"The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed …","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-617"],"vendor":"MongoDB","product":"C Driver","affected":["c_driver >= 1.25.0 <= 1.30.14","c_driver >= 2.0.0 <= 2.5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T20:01:40.053743Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T20:01:51.405Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120956","references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-6501"}],"tags":["cve.org"],"epss":0.00252,"epssPercentile":0.16845,"ingestedAt":"2026-11-05T20:33:06.428Z","slug":"CVE-2026-120956","body":"## Overview\n\nThe MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.\n\n## Affected\n\n- `c_driver >= 1.25.0 <= 1.30.14`\n- `c_driver >= 2.0.0 <= 2.5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}