{"id":"CVE-2026-120684","published":"2026-11-03T19:18:00.080","lastModified":"2026-11-03T21:17:04.137","description":"A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-908"],"vendors":[],"products":[],"references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-6508","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}