Bug 2548210 (CVE-2026-106433)

Summary: CVE-2026-106433 libmongocrypt: libmongocrypt: Memory corruption and denial of service via duplicate masterKey fields
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libmongocrypt. This vulnerability allows an authenticated attacker with permissions to modify key vault documents, or a malicious server returning crafted documents, to cause process memory corruption or a Denial of Service (DoS) by crashing the application. The issue occurs during the cleanup of key documents containing duplicate masterKey fields, causing data to be handled as an incompatible type and leading to invalid memory operations. Consequently, the client application may terminate unexpectedly or experience corrupted memory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2548578, 2548579    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-08 19:12:41 UTC 
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.