The vulnerability arises from an out‑of‑bounds read in the CGo bindings used by the MongoDB Go Driver’s GSSAPI authentication on Linux and macOS. An attacker could trigger a read of one byte past a heap buffer when the driver processes a Kerberos token that is not null‑terminated. This leads to either a crash of the application or inadvertent exposure of memory contents that may contain sensitive information. No direct code execution is possible, but the instability and data leakage pose a moderate threat to confidentiality and availability.

The issue affects MongoDB Inc’s MongoDB Go Driver whenever GSSAPI authentication is enabled on Linux or macOS. Exact vulnerable versions are not listed; therefore any release up to the latest that has not applied the corrective wrapper adjustments is potentially impacted.

With a CVSS score of 6.9 the vulnerability is classified as medium severity. The EPSS score of less than 1 % indicates a low probability of exploitation at the time of analysis. The attack vector is likely local or requires the ability to send crafted Kerberos tokens to the driver, so it is not an arbitrary external exploit. The vulnerability is not currently listed in CISA’s KEV catalog. The risk is thus moderate but potentially significant for applications that rely on GSSAPI authentication.