CVE-2026-120684 — Vulnerability intelligence
—
Published:
- CVSS
- 6
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.