CVE-2025-12657CWE-754

CVE-2025-12657

Medium · published November 4, 2025

CVSS v3.1
5.0
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.1th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2025-11-04T02:18Z
Affected products (2)
ProductVersionsFixed in
mongodb/mongodb≥ 6.0.0, < 7.0.227.0.22
mongodb/mongodb≥ 8.0.0, < 8.0.108.0.10
References (1)
https://jira.mongodb.org/browse/SERVER-101230 · [email protected]
EPSS history
Timeline
  • 03 NOV 21:03Z
    Malformed KMIP response may result in access violation
    cvelistv5