A 32‑bit wrap‐around bug in the MongoDB C Driver’s Windows‑only Kerberos/SSPI authentication stack can cause an undersized heap buffer to be allocated when an overly long credential string is supplied in the client connection configuration. This buffer underrun may lead to corruption of the driver’s process memory and can result in a client application crash or denial of service. The weakness is a classic integer overflow, classified as CWE‑190.

The vulnerability affects the MongoDB C Driver across both 1.x and 2.x branches, specifically in builds compiled with the Windows‑native authentication backend. Versions released prior to the 1.30.14 and 2.5.7 updates contain the flaw; the referenced releases contain a patch that eliminates the wrap‑around condition.

The CVSS score of 5.7 indicates moderate severity. EPSS and KEV data are unavailable, suggesting no widely reported exploitation at this time. The likely attack vector requires an attacker who can control the client‑side configuration or supply a crafted connection string, implying a local or trusted‑user threat. In the absence of a public exploit, the risk remains medium, with mitigation through updating the driver being the most effective countermeasure.