The MongoDB C Driver version 2.1.0 contains a buffer overflow vulnerability (CWE-120) in its Cyrus SASL integration component. During the process of canonicalizing usernames for GSSAPI authentication, the driver performs unsafe string copying without verifying the size of the input. This can result in a heap buffer overflow before any authentication or network communication occurs, potentially leading to memory corruption or application crashes. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity. No patch or official remediation has been published by MongoDB Inc. as of the publication date.

Successful exploitation of this vulnerability could cause a heap buffer overflow in the MongoDB C Driver, potentially leading to application crashes or memory corruption. Because the overflow occurs before authentication or network traffic, it may allow an attacker to disrupt service or possibly execute arbitrary code depending on the context. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid passing untrusted input in the username field of MongoDB URIs when using the GSSAPI authentication mechanism. Monitoring vendor channels for updates is recommended.