CVE-2026-88032

CVE-2026-88032 is a use-after-free (CWE-416) in the reactive client-side encryption component of the MongoDB Java Driver, in which native resources can be freed while a still-running encrypted operation is using them. The issue is reachable only when the application uses a reactive encryption configuration that retrieves KMS credentials on demand, and it is triggered when an attacker or component able to cause such an in-flight encrypted operation to be cancelled does so. The result is an availability-only impact: the hosting application process can terminate, with no confidentiality or integrity loss (CVSS 4.0 vector shows VA:H with VC:N/VI:N, scored 8.2 High). Affected parties are JVM application developers embedding the MongoDB Java Driver with reactive streams plus client-side encryption and on-demand KMS credential retrieval; MongoDB deployments that do not use client-side encryption, or that use the sync/standard async drivers, are not affected. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Audit JVM applications for use of the MongoDB Java Driver's reactive streams API with client-side encryption configured to fetch KMS credentials on demand; if present, upgrade to the fixed driver version identified in MongoDB's security advisory (version numbers not provided in the available data). Until patched, limit which callers can cancel in-flight encrypted operations, and monitor MongoDB's advisory for version and mitigation details.