CVE-2026-114645: CWE-190: Integer Overflow or Wraparound in MongoDB C Driver

This vulnerability involves a 32-bit integer wraparound in the Windows-specific Kerberos/SSPI authentication code of the MongoDB C Driver. When a client supplies an excessively long credential value in its connection configuration, the integer overflow causes the driver to allocate a heap buffer smaller than needed. Consequently, the driver may write outside the allocated buffer bounds, leading to memory corruption and denial of service in the client application. The flaw is limited to client builds compiled with the Windows-native authentication backend and does not affect other platforms or authentication methods.

An attacker who can control the client-side connection configuration and uses the affected Windows-native authentication mechanism can trigger out-of-bounds writes in the client process memory. This can corrupt memory and cause the client application to crash, resulting in denial of service. There is no indication of remote code execution or broader system compromise from this vulnerability. Exploitation requires high privileges and user interaction, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using excessively long credential values in the client connection configuration when using the Windows-native authentication backend. Consider using alternative authentication mechanisms or platforms not affected by this issue. Monitor MongoDB's official advisories for updates and patches addressing this vulnerability.