Bug 2566164 (CVE-2026-120684)

Summary: CVE-2026-120684 mongo-c-driver: mongo-c-driver: Information disclosure via uninitialized memory in legacy GridFS file handling
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in mongo-c-driver. An uninitialized memory vulnerability in legacy GridFS file handling can lead to information disclosure. An authenticated database user with write access to a shared storage area can trigger conditions that cause the application to store uninitialized process memory in records on the server. By reading these records, the user may obtain sensitive process data, including credentials.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2567220, 2567221    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-03 19:53:40 UTC 
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.