CVE-2026-106433

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

• CWE-843

• https://jira.mongodb.org/browse/MONGOCRYPT-964

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106428An out-of-bounds read in SCRAM authentication response parsi…3.7
• CVE-2026-106429An integer underflow in the KMS endpoint-parsing logic of Mo…6.5
• CVE-2026-10643Zephyr's IP socket recvmsg() implementation (subsys/net/lib/…7.8
• CVE-2026-106430The MongoDB C++ Driver discards content after an embedded NU…5.9
• CVE-2026-106431An off-by-one error in the BSON bulk document writer in the …5.7
• CVE-2026-106432The BSON encoder in the MongoDB PHP Driver converts a string…3.6
• CVE-2026-106434The explicit decryption component of MongoDB libmongocrypt c…4.3
• CVE-2026-106436The BSON encoder in the MongoDB PHP Driver does not check so…4.8
• CVE-2026-106437The BSON buffer-reservation API in the MongoDB C Driver can …6.2
• CVE-2026-106438An incorrect calculation in Decimal128 string parsing in the…4
• CVE-2026-106439Hydra is a framework for elegantly configuring complex appli…8.5
• CVE-2026-10644The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mch…3.1