CVE-2026-106433

Name of the Vulnerable Software and Affected Versions libmongocrypt (affected versions not specified)

Description Improper state management occurs when cleaning up a key document that contains duplicate masterKey fields, causing provider-specific data to be treated as an incompatible type. An authenticated actor with permissions to modify key vault documents, or a server returning such a document, can trigger invalid memory access and invalid frees within the client process. This may lead to application termination or corruption of process memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.