CVE-2026-106434: CWE-354: Improper Validation of Integrity Check Value in MongoDB libmongocrypt

The vulnerability in MongoDB libmongocrypt (CVE-2026-106434) arises from improper validation of integrity check values in the explicit decryption component. Specifically, when the component encounters an unrecognized encrypted payload, it returns the payload unchanged rather than producing a decryption error. This behavior can be exploited by an attacker who can modify encrypted fields—such as a database writer, server, or network intermediary—to supply crafted bytes that the application then processes as if they were valid decrypted plaintext. The affected versions are >=1.5.0 and <1.20.5. The CVSS 4.0 base score is 5.3, indicating medium severity.

An attacker with the ability to modify stored encrypted fields can cause the application to process manipulated ciphertext as decrypted plaintext. This may lead to incorrect application behavior or data integrity issues. However, the vulnerability does not involve privilege escalation, user interaction, or confidentiality compromise directly, and the attack requires the ability to modify encrypted data at rest or in transit.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to encrypted fields to trusted entities only and monitor for unauthorized modifications.