An out‑of‑bounds write occurs in the connection‑monitoring logic of the MongoDB C Driver when an attacker controls name resolution and the responses of the hosts listed in a client’s connection string. The vulnerability allows the attacker to write beyond the end of a heap buffer, which may lead to an application crash and denial of service. The fault does not provide direct code execution but can terminate the host application unexpectedly.

All releases of the MongoDB C Driver prior to version 1.30.12 of the 1.x series and prior to 2.5.5 of the 2.x series are vulnerable. The fix is incorporated in releases 1.30.12, 2.5.5, and later. There is no other vendor or product mentioned.

The CVSS score of 8.3 indicates high severity, and no EPSS data is available to gauge current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalogue. As inferred from the description, an unauthenticated attacker who can influence DNS or host resolution for a client’s connection string can trigger the exploit, making the attack vector a remote network based on name resolution manipulation. The risk is significant for services relying on the vulnerable driver, especially when exposed to untrusted networks.