CVE-2026-120684

Sin historial EPSS suficiente todavía.

A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.

• jira.mongodb.orghttps://jira.mongodb.org/browse/CDRIVER-6508