Skip to content
OpenAdvisories
High · 8.8 CVE-2026-106433 EUVD-2026-95162

Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

Published Oct 8, 2026 · Updated Oct 8, 2026 · Assigned by mongodb

Description

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

Affected products

VendorProductAffectedFixed
MongoDB libmongocrypt 1.1.0 – < 1.20.5 1.20.5

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libmongocrypt 1.20.5-1 —
Debian 13 libmongocrypt No fix yet —
Debian 12 libmongocrypt No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libmongocrypt No fix yet —
Ubuntu 26.04 LTS libmongocrypt No fix yet —
Ubuntu 24.04 LTS libmongocrypt No fix yet —
Ubuntu 22.04 LTS libmongocrypt No fix yet —

Advisories 1

References