{"affected":[{"defaultStatus":"unaffected","product":"Libmongocrypt Driver","source":"CNA: mongodb","vendor":"MongoDB","versions":[{"lessThanOrEqual":"1.21.2","status":"affected","version":"1.1.0","versionType":"python"}]}],"cveId":"CVE-2026-126792","cwes":["CWE-787"],"description":"A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the library is embedded by a caller that supplies its own cryptographic callback implementation, data larger than the buffer can be written past its end. Exploitation requires the ability to control the embedding application's in-process key-management provider configuration, a high-privilege position. The demonstrated impact is memory corruption resulting in abnormal termination of the client process.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.6,"severity":"medium","source":"CNA: mongodb","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":4.7,"severity":"medium","source":"CNA: mongodb","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","version":"3.1"}],"modifiedAt":1794527592989,"publishedAt":1794527592989,"references":[{"source":"CNA: mongodb","tags":[],"url":"https://jira.mongodb.org/browse/MONGOCRYPT-975"},{"source":"CNA: mongodb","tags":[],"url":"https://jira.mongodb.org/browse/PYTHON-5999"}],"remediation":[],"revision":"2727861b31261894bb74f171106e4dc15a76e32f1573fe14c7d5c49deace4cc5","sources":[{"modifiedAt":1794527592989,"name":"CNA: mongodb","retrievedAt":1794528548278,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126792"}],"ssvc":null,"status":"published","title":"Heap overflow via oversized RSA signature in GCP KMS signing callback","updatedAt":1794528548278}