CVE-2026-9100 Details
Description
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).
A vulnerability exists in the MongoDB C Driver's legacy GridFS API, where malformed file metadata is accepted from the database without proper validation. This flaw can lead to two potential issues: applications reading these files via the legacy API may crash due to a division-by-zero error, or they may unintentionally expose process memory contents through an out-of-bounds read.
Users can upgrade to MongoDB C Driver versions 1.30.8 or 2.2.4, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jira.mongodb.org/browse/CDRIVER-6281 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mongodb c driver | >= 1.10.0, < 1.30.8 >= 2.0.0, < 2.2.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | New CVE Received | [email protected] |