CVE-2026-120684

Name	CVE-2026-120684
Description	A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mongo-c-driver (PTS)	bookworm	1.23.1-1+deb12u3	vulnerable
	trixie	1.30.4-1+deb13u3	vulnerable
	forky	2.5.7-1	vulnerable
	sid	2.5.8-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mongo-c-driver	source	(unstable)	2.5.8-1

Notes

[trixie] - mongo-c-driver <no-dsa> (Minor issue)
https://jira.mongodb.org/browse/CDRIVER-6508
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/fe5764b2caaaf368e924b8eef8ee2e5c5700120d (2.5.8)
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/edde153ac24b5c68d768f8a3c8dd0a435000466c (1.30.15)