CVE-2026-120684
Description
A flaw was found in mongo-c-driver. An uninitialized memory vulnerability in legacy GridFS file handling can lead to information disclosure. An authenticated database user with write access to a shared storage area can trigger conditions that cause the application to store uninitialized process memory in records on the server. By reading these records, the user may obtain sensitive process data, including credentials.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory; Read Application Data
When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash.
Other
Technical Impact: Unexpected State; Varies by Context
The consequences vary depending on the type of resource and how it is used within the product.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
