CVE-2026-106433: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') in MongoDB libmongocrypt

The vulnerability CVE-2026-106433 in MongoDB libmongocrypt arises from improper state management during cleanup of key documents with duplicate masterKey fields. This results in type confusion where provider-specific data is misinterpreted as an incompatible type. Exploitation requires an authenticated actor with the ability to modify key vault documents or a malicious server returning crafted key documents. The consequence is invalid memory access and invalid frees, which can cause application crashes or memory corruption in the client process. The CVSS 4.0 score is 8.7, indicating high severity.

An authenticated attacker who can modify key vault documents or a malicious server returning crafted key documents can cause invalid memory operations in the client using libmongocrypt. This can lead to application termination or memory corruption, impacting the stability and security of client applications relying on this library.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance before deploying or updating libmongocrypt. Until a fix is available, restrict access to key vault documents to trusted actors only and validate key documents from servers.