CVE-2025-14911: MongoDB Mongo-C-Driver

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.

Affected products

• MongoDB Mongo-C-Driver: before 2.1.3 (fixed in 2.1.3)

Published 2026-01-27. Last modified 2026-06-17.