CVE-2025-12657 — Malformed KMIP response may result in access violation

CVE-2025-12657

Malformed KMIP response may result in access violation PUBLISHED

Description (CNA)

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.

Affected (CNA)

Vendor / product	Versions
MongoDB Inc. / MongoDB Server	affected 6.0 before 7.0.22; affected 8.0 before 8.0.10

CWE

CWE-754

References

https://jira.mongodb.org/browse/SERVER-101230

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.