CVE-2026-84971

7.1 highEPSS 0.3%

High (7.1) in mongodb libmongocrypt. EPSS 0.3% chance of exploitation in the next 30 days.

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-617
Published: 2026-09-03
Modified: 2026-09-17
Record from: the NVD, synced 2026-10-19

Affected

mongodb:libmongocrypt

References

https://jira.mongodb.org/browse/MONGOCRYPT-971

Check your stack JSON