CVE-2026-106428: CWE-125: Out-of-bounds Read in MongoDB C Driver

This vulnerability involves an out-of-bounds read (CWE-125) in the SCRAM authentication response parsing logic of the MongoDB C Driver. Specifically, when a malformed server-final message is processed, the driver reads one byte beyond the allocated buffer. An attacker controlling the server or a network intermediary can exploit this by sending a crafted message before server-signature verification, causing the application to terminate unexpectedly. The vulnerability does not leak data beyond the extra byte read, as it is not returned through the protocol.

The impact is limited to application termination (denial of service) due to the out-of-bounds read triggered by a malformed message. There is no indication of data leakage or privilege escalation. The vulnerability requires an attacker to be able to provide a malicious server-final message before server-signature verification, which limits the attack surface.

No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, applications should consider additional network-level protections to prevent untrusted intermediaries from injecting malformed messages.