CVE-2026-84971: CWE-617: Reachable Assertion in MongoDB libmongocrypt

This vulnerability arises from an internal check failure in the client-side encryption library libmongocrypt used by MongoDB. When the library encounters an unexpected size of encrypted data during decryption, it triggers an assertion failure that terminates the process. An attacker capable of placing a malicious encrypted value where the application decrypts it, or controlling the responses the application receives, can exploit this to cause denial of service by stopping the application.

Successful exploitation results in the termination of the application process using libmongocrypt, causing a denial of service. There is no indication of data leakage or privilege escalation from the provided information.

No patch or official fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should consider restricting or validating inputs that may be decrypted by libmongocrypt to prevent injection of malformed encrypted values.