CVE-2026-9100: CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input in MongoDB, Inc. C Driver
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).
AI Analysis
Technical Summary
The MongoDB C Driver's legacy GridFS API improperly validates specified indexes, positions, or offsets in input metadata retrieved from the database. Malformed documents in a GridFS collection can trigger a division-by-zero crash or cause an out-of-bounds read that leaks process memory when accessed via the legacy API. This vulnerability affects versions 1.0 and 2.0 of the driver and has been assigned CVE-2026-9100 with a CVSS 4.0 score of 6. No vendor advisory or patch information is currently provided.
Potential Impact
Exploitation of this vulnerability can cause applications using the legacy GridFS API to crash unexpectedly or leak sensitive process memory contents. This could lead to denial of service or information disclosure. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding use of the legacy GridFS API or implement additional input validation on metadata retrieved from the database to mitigate potential crashes or memory leaks.
CVE-2026-9100: CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input in MongoDB, Inc. C Driver
Description
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The MongoDB C Driver's legacy GridFS API improperly validates specified indexes, positions, or offsets in input metadata retrieved from the database. Malformed documents in a GridFS collection can trigger a division-by-zero crash or cause an out-of-bounds read that leaks process memory when accessed via the legacy API. This vulnerability affects versions 1.0 and 2.0 of the driver and has been assigned CVE-2026-9100 with a CVSS 4.0 score of 6. No vendor advisory or patch information is currently provided.
Potential Impact
Exploitation of this vulnerability can cause applications using the legacy GridFS API to crash unexpectedly or leak sensitive process memory contents. This could lead to denial of service or information disclosure. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding use of the legacy GridFS API or implement additional input validation on metadata retrieved from the database to mitigate potential crashes or memory leaks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-05-20T15:13:47.129Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0de26eba1db473628f2ed2
Added to database: 5/20/2026, 4:33:50 PM
Last enriched: 5/20/2026, 4:48:59 PM
Last updated: 5/20/2026, 6:42:11 PM
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.