CVE-2026-106433: MongoDB libmongocrypt Use-After-Free

CVE-2026-106433 Overview

CVE-2026-106433 is a type confusion vulnerability [CWE-843] in MongoDB libmongocrypt. The flaw stems from improper state management when cleaning up a key document that contains duplicate masterKey fields. Provider-specific data is treated as an incompatible type during cleanup, leading to invalid memory access and invalid frees in the client process.

An authenticated actor who can modify key vault documents, or a server that returns a crafted key document, can trigger the condition. The result is application termination or process memory corruption in the MongoDB client using libmongocrypt.

Critical Impact
Authenticated attackers with key vault write access, or a malicious server, can crash MongoDB clients and potentially corrupt client process memory through type confusion in libmongocrypt.

Affected Products

MongoDB libmongocrypt
MongoDB client drivers and applications linking libmongocrypt
MongoDB Client-Side Field Level Encryption (CSFLE) and Queryable Encryption workflows

Discovery Timeline

2026-10-08 - CVE-2026-106433 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-106433

Vulnerability Analysis

The vulnerability resides in libmongocrypt, the library that performs client-side encryption for MongoDB. When libmongocrypt parses a key document that contains more than one masterKey field, its internal state tracking becomes inconsistent. During cleanup, the library interprets provider-specific data under the assumption it holds a type that no longer matches the actual stored value.

This type confusion [CWE-843] drives the cleanup routine to dereference pointers and free memory using incorrect structural assumptions. The outcome is invalid memory access and invalid free() calls inside the client process. Affected clients either terminate abruptly or exhibit heap corruption that can influence subsequent memory operations.

Because the vulnerable code path runs inside the trusted client, the fault is reachable from two directions: a malicious or compromised MongoDB server returning crafted key documents, and an authenticated principal with write access to the key vault collection.

Root Cause

The root cause is improper state management when the key document schema contains duplicate masterKey fields. libmongocrypt does not reject or normalize the duplicate keys, and its internal provider-type tag diverges from the actual field contents by the time cleanup executes. Cleanup then treats provider-specific data as the wrong type, violating the invariants expected by the free routine.

Attack Vector

Exploitation requires network access to a MongoDB deployment using libmongocrypt and either low-privilege authenticated access with permission to modify key vault documents or control of the MongoDB server responding to the client. The attacker places a document with duplicate masterKey fields into the key vault, or returns such a document from the server. When the client processes and later cleans up the document, the invalid free executes.

No verified public exploit code is available. See the MongoDB Issue Tracking MONGOCRYPT-964 entry for technical details.

Detection Methods for CVE-2026-106433

Indicators of Compromise

Unexpected crashes or SIGABRT / SIGSEGV terminations in applications linking libmongocrypt
Heap corruption diagnostics such as malloc_consolidate(): invalid chunk size or double free or corruption emitted by glibc from client processes
Key vault documents containing more than one masterKey field detected during collection audits
Repeated client reconnects or encryption operation failures following reads from the key vault

Detection Strategies

Query the key vault collection and flag any BSON documents whose top-level field set contains duplicate masterKey entries.
Enable core dumps and crash telemetry on hosts running MongoDB client workloads to capture evidence of invalid frees originating in libmongocrypt symbols.
Correlate MongoDB server audit logs for update and insert operations against the key vault collection with the identities authorized to touch key material.

Monitoring Recommendations

Monitor authenticated activity against the key vault namespace and alert on writes from accounts outside the key management workflow.
Track process termination events for applications that embed libmongocrypt and route them to a central logging pipeline for triage.
Review driver and application logs for repeated CSFLE or Queryable Encryption failures that align with changes to the key vault.

How to Mitigate CVE-2026-106433

Immediate Actions Required

Upgrade libmongocrypt to the fixed version published by MongoDB as referenced in MONGOCRYPT-964.
Audit the key vault collection and remove or correct any documents containing duplicate masterKey fields.
Restrict write access on the key vault collection to a minimal set of key-management identities using MongoDB role-based access control.
Verify TLS and server identity for all client connections so a rogue or spoofed server cannot deliver crafted key documents.

Patch Information

MongoDB tracks the fix under MONGOCRYPT-964. Apply the updated libmongocrypt build in every driver, application, and mongocryptd deployment that performs client-side encryption. Rebuild and redeploy applications that statically link the library.

Workarounds

Enforce least-privilege authorization on the key vault collection to block low-privilege accounts from writing key documents.
Validate key documents at insert time with a schema check that rejects BSON containing duplicate masterKey fields.
Pin client applications to known-good MongoDB servers and require mutual TLS to prevent a hostile server from returning crafted key documents.

bash

# Example: restrict key vault writes to a dedicated role
mongosh --eval '
  db.getSiblingDB("admin").createRole({
    role: "keyVaultWriter",
    privileges: [{
      resource: { db: "encryption", collection: "__keyVault" },
      actions: [ "insert", "update", "remove", "find" ]
    }],
    roles: []
  })
'