CVE-2026-120684
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
unknown
Description
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.