Security Resilience

CVE-2026-9100

Mongodb C Driver 1.10.0 – 1.30.8

Published
20 May 2026
Modified
24 September 2026
Patch / advisory
View advisory
CVSS Score v4 6.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0030 23th percentile
Risk Priority 34 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-9100 is a medium-severity Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) vulnerability in Mongodb C Driver. Its CVSS base score is 6.0 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a…

more

division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

CWE(s)
CWE-1285

Related Threats

MITRE ATT&CK Enterprise Techniques

MITRE ATT&CK v20.0

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-4359Same product: Mongodb C Driver
CVE-2026-84964Same product: Mongodb C Driver
CVE-2026-93393Same product: Mongodb C Driver
CVE-2026-6691Same product: Mongodb C Driver
CVE-2023-0437Same product: Mongodb C Driver
CVE-2026-6231Same product: Mongodb C Driver
CVE-2026-88036Same product: Mongodb C Driver
CVE-2025-12119Same product: Mongodb C Driver
CVE-2026-18888Same vendor: Mongodb
CVE-2026-82067Same vendor: Mongodb

Affected Assets

mongodb
c driver
1.10.0 — 1.30.8 · 2.0.0 — 2.2.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V2.1.1
  • V2.2.1
  • V2.2.2
  • V5.3.3

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

SI-10 Information Input Validation good match

Requires explicit validation of supplied indices/offsets/positions before they are used to access buffers or other indexable resources.

Mitigating Controls (NIST CSF 2.0)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly require input validation, preventing this class of flaw at development time.

ID.RA-01 partial match
blocks

Vulnerability identification processes can discover missing index validation via scanning or reviews.

PR.PS-02 partial match
blocks

Patching and replacement can remediate instances of the weakness after discovery.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect missing or incorrect index validation during development and acceptance.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly require validation of indices, positions, and offsets before use.

References