CVE-2026-88032

Name of the Vulnerable Software and Affected Versions MongoDB Java Driver (affected versions not specified)

Description A use-after-free issue exists in the reactive client-side encryption component. This occurs when an encrypted operation is cancelled, causing native resources to be freed while they are still in use. An attacker capable of triggering the cancellation of such an operation may cause the hosting application process to terminate. This issue specifically affects reactive encryption configurations that retrieve Key Management Service (KMS) credentials on demand.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.