---
id: CVE-2026-120684
title: >-
  MongoDB C Driver GridFS gap lets a shared writer recover a protected client's
  password
summary: >-
  A memory-initialization flaw in the legacy GridFS file handling of the MongoDB
  C Driver can cause uninitialized process memory to be treated as valid file
  content and stored on the server. A database user holding ordinary write
  access to…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-908
vendor: MongoDB
product: C Driver
affected:
  - c_driver >= 1.25.0 <= 1.30.14
  - c_driver >= 2.0.0 <= 2.5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T20:10:55.996365Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:11:10.303Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120684'
references:
  - url: 'https://jira.mongodb.org/browse/CDRIVER-6508'
tags:
  - cve.org
epss: 0.00322
epssPercentile: 0.25316
ingestedAt: '2026-11-05T20:33:06.431Z'
---

## Overview

A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.

## Affected

- `c_driver >= 1.25.0 <= 1.30.14`
- `c_driver >= 2.0.0 <= 2.5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.