An unexpected value size in the decryption path of a client‑side encryption library causes an internal check failure that terminates the process using the library. The flaw is a wrapper integrity violation (CWE‑617). When triggered, the application stops running, resulting in a denial of service. The description does not indicate additional data corruption or information disclosure, only an abrupt termination of the client process.

The vulnerable component is MongoDB’s libmongocrypt, the encryption library used by MongoDB drivers and applications. No specific version information is provided, so all installations of libmongocrypt that include the undisclosed decryption path logic are potentially affected.

The CVSS score is 7.1, indicating moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. Based on the description, it is inferred that a party able to supply a suitably formed encrypted value or influence the ciphertext received by the client can trigger the crash. Remote delivery of crafted ciphertext via an untrusted data source would be the most likely attack vector, though local execution may also be possible if the attacker can inject data into the application environment.