The vulnerability arises in the MongoDB C Driver’s Cyrus SASL implementation, where unsafe string copying during username canonicalization can overflow a heap buffer. This occurs before any authentication or network traffic proceeds, so an attacker can trigger it simply by supplying crafted username data in a MongoDB URI that specifies GSSAPI authentication. If the overflow is exploited successfully, it can lead to arbitrary code execution on the system hosting the driver, compromising confidentiality, integrity, and availability of that machine.

The flaw affects the MongoDB C Driver distributed by MongoDB Inc. No specific version information is available in the entry, but any release that has not applied the fix from database entry CDRIVER-6134 is at risk. The impact does not appear to be limited to a particular deployment scenario beyond usage of the driver in applications that process untrusted URIs.

The CVSS score of 8.6 indicates high severity and the risk of exploitation is significant, especially for systems that expose the driver to external input. Because no EPSS score is publicly available and the vulnerability is not listed in CISA KEV, the exploitation probability is unclear but potentially non-negligible. The likely attack vector is remote delivery of a malformed MongoDB URI containing a crafted GSSAPI username; the exploit requires only that the vulnerable driver processes the URI before authentication.