CVE-2025-12657
MEDIUM severity · CVSS 5 · CWE-754
5CVSS MEDIUM
Summary
The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.
Impact & exploitability
Attack vectorNetwork
Attack complexityHigh
Privileges requiredHigh
User interactionNone
Confidentiality impactLow
Integrity impactNone
Availability impactHigh
Exploit probability (EPSS)0%
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.