CVE-2025-12657

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.

CVSS 4.0

5.9CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

5.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-25)

CWE

CWE-754

Published

2025-11-03

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• mongodb:mongodb

References

• https://jira.mongodb.org/browse/SERVER-101230

Check your stackJSON