CVE-2026-88032
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-416
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- MongoDB Java Driver
Weakness type
Related vulnerabilities
- CVE-2026-87933 — DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
- CVE-2026-87877 — zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
- CVE-2026-87825 — zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
- CVE-2026-87617 — Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-87448 — Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87634 — Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87609 — Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote...
- CVE-2026-87526 — Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...