CVE-2026-84971
Received Received - Intake

Heap Overflow in Client-Side Encryption Library

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: MongoDB, Inc.

Description
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-84971
EUVD
EUVD-2026-70507

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of unexpected value sizes during decryption in a client-side encryption library. When a malformed encrypted value is processed or responses are controlled by an attacker, it triggers a failed internal check that crashes the application using the library.

Detection Guidance

This vulnerability involves improper handling of encrypted values causing process termination. Detection requires monitoring for unexpected application crashes during decryption operations. Check application logs for segmentation faults or abnormal terminations when processing encrypted data. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to cause applications relying on the encryption library to crash, leading to denial of service. This may disrupt services, cause data unavailability, or require application restarts to recover.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or data unavailability, which may violate availability requirements in GDPR or HIPAA. Repeated crashes could also indicate poor security practices, potentially affecting compliance assessments.

Mitigation Strategies

Immediate mitigation involves updating the client-side encryption library to the latest patched version. Validate all decrypted input sizes before processing. Implement input validation for encrypted values. Monitor application stability during decryption operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart