CVE-2026-88032
Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in MongoDB Java Driver Encryption

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: MongoDB, Inc.

Description
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88032
EUVD
EUVD-2026-75668

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb java_driver *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the reactive client-side encryption component of the MongoDB Java Driver. It occurs when native resources are freed while an encrypted operation is still using them, specifically when the operation is cancelled. This can cause the hosting application process to terminate if an attacker triggers such a cancellation.

Impact Analysis

An attacker who can cause an encrypted operation to be cancelled may be able to crash the application using the MongoDB Java Driver. This could lead to denial of service, data unavailability, or potential data corruption if the application fails to recover properly.

Mitigation Strategies

Update the MongoDB Java Driver to a version that fixes the use-after-free issue in the reactive client-side encryption component. Avoid configurations that retrieve KMS credentials on demand for reactive encryption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart