CVE-2025-12657

The record

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.

Affected packages

Related vulnerabilities

• CVE-2025-14345 A post-authentication flaw in the network two-phase commit protocol used for cross-shard… Also affects mongodb
• CVE-2025-13643 A user with access to the cluster with a limited set of privilege actions may be able to… Also affects mongodb
• CVE-2025-13644 MongoDB Server may experience an invariant failure during batched delete operations when… Also affects mongodb
• CVE-2025-13507 Inconsistent object size validation in time series processing logic may result in later… Also affects mongodb
• CVE-2025-12893 Clients may successfully perform a TLS handshake with a MongoDB server despite presenting… Also affects mongodb
• CVE-2024-8305 prepareUnique index may cause secondaries to crash due to incorrect enforcement of index… Also affects mongodb
• CVE-2024-7553 Incorrect validation of files loaded from a local untrusted directory may allow local… Also affects mongodb
• CVE-2024-3372 Improper validation of certain metadata input may result in the server not correctly… Also affects mongodb