CVE-2026-106433

Summary

The flaw involves improper state management in MongoDB's libmongocrypt, allowing an authenticated actor to cause memory corruption and application termination. This matters because it can lead to service disruption and potential data corruption.

Exploitability

Exploitation requires an authenticated actor who can modify key vault documents. The attack is moderately complex and depends on the ability to inject specific payload data.

Blast radius

If exploited, this can terminate the application or corrupt process memory, impacting the availability and integrity of the MongoDB service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of MongoDB that addresses this vulnerability, specifically version 4.4.16 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.