CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-106433

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-106433

Improper state management in MongoDB libmongocrypt allows for heap corruption when cleaning up a key document that contains duplicate masterKey fields. This flaw causes provider-specific data to be treated as an incompatible type, leading to invalid memory access and invalid frees in the client p...

CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...