BaseFortify

Publication date: 2025-11-03

Last updated on: 2025-12-12

Assigner: MongoDB, Inc.

Description

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-03

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-11-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12657

EUVD

EUVD-2025-37518

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 6.0.0 (inc) to 7.0.22 (exc)
mongodb	mongodb	From 8.0.0 (inc) to 8.0.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

Executive Summary

This vulnerability involves the KMIP response parser in mongo binaries being overly tolerant of certain malformed packets, which can cause it to parse these packets into invalid objects. Subsequent reads of these invalid objects may lead to read access violations.

Impact Analysis

The vulnerability can lead to read access violations when the system processes malformed KMIP response packets. This could potentially cause application crashes or instability, impacting availability.

Hi! I’m here to help you understand CVE-2025-12657. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70