CVE-2026-106433

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-27

Assigner: MongoDB, Inc.

Description

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-27

Generated

2026-11-08

AI Q&A

2026-10-08

EPSS Evaluated

2026-11-07

NVD

CVE-2026-106433

EUVD

EUVD-2026-95162

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	libmongocrypt	From 1.5.0 (inc) to 1.20.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper state management in MongoDB libmongocrypt. When a key document contains duplicate masterKey fields, the system may incorrectly treat provider-specific data as an incompatible type during cleanup. This leads to invalid memory access and invalid frees in the client process, potentially causing the application to terminate or corrupt memory.

Detection Guidance

This vulnerability involves improper state management in MongoDB libmongocrypt, leading to memory corruption. Detection requires checking for crashes or memory corruption in applications using libmongocrypt, particularly when handling key vault documents with duplicate masterKey fields.

Impact Analysis

An authenticated attacker who can modify key vault documents or a malicious server returning such documents could exploit this flaw. This may result in application crashes, memory corruption, or arbitrary code execution in the client process, depending on the environment and usage.

Compliance Impact

This vulnerability could lead to memory corruption or application termination, potentially causing data leaks or integrity issues. Such impacts may violate GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update libmongocrypt to the latest patched version immediately. Review key vault documents for duplicate masterKey fields and remove any duplicates. Monitor applications for crashes or memory corruption as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-106433. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...