A memory‑initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can treat uninitialized process memory as valid file content and persist it on the server. If a database user with ordinary write access to a shared storage area arranges that an application subsequently appends to such a file, the driver may write that leaked memory into records the user can then read, exposing sensitive information such as credentials or other secrets.

MongoDB C Driver version 2.5.5 is affected. The vulnerability is specific to the legacy GridFS implementation in that release.

The CVSS score of 6.0 indicates a medium severity confidentiality risk. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no widely known public exploits yet. Exploitation requires a legitimate write operation to a shared GridFS area; the attacker would need to be a database user with normal write rights. Once the uninitialized data is persisted, any subsequent read by the same user or other authorized users could disclose sensitive data from the application’s process space. No denial‑of‑service or code execution is possible according to the description.