The update fixes three vulnerabilities in python-pymongo. CVE-2026-96747 involves improper handling of key management endpoint values ending with `.sock`, enabling users with write access to encryption key metadata to open local socket connections on the host. CVE-2026-96748 is a host injection vulnerability in connection string parsing that can cause database connection redirection. CVE-2026-96749 is an integer overflow in BSON document encoding that allows an unprivileged user to write outside the bounds of an allocated buffer, potentially leading to memory corruption.

Exploitation of these vulnerabilities could allow unauthorized local socket connections, redirection of database connections, and memory corruption through buffer overflow. This can lead to unauthorized access, data manipulation, or application instability. However, there are no known exploits in the wild at this time.

The vendor has released a security update addressing these vulnerabilities. Users should apply the update to remediate these issues. No additional mitigation guidance is provided or required beyond applying the update.