{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MongoDB",
          "vendor": "Mongodb",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap buffer underflow vulnerability exists in the readline() function of\nOpenLDAP\u0027s Lightning Memory-Mapped Database (LMDB) mdb_load utility. The\nvulnerability is triggered through malformed input data and results in an\nout-of-bounds read one byte before an allocated heap buffer. This can lead\nto information disclosure through heap memory leakage.\n\n*Root Cause:*\nThe vulnerability occurs in the readline() function at line 214 of\nmdb_load.c. The ASAN output reveals two critical issues:\n1. *Integer Underflow:* An unsigned offset addition to 0x521000000100\nresults in underflow to 0x5210000000ff, indicating a pointer decrement\noperation that wraps below the buffer start\n2. *Out-of-bounds Read: *The subsequent memory access reads 1 byte at\naddress 0x5210000000ff, which is located 1 byte before the 4096-byte heap\nregion [0x521000000100, 0x521000001100)\n\n*Impact:*\nThe vulnerability allows a local attacker to trigger a heap out-of-bounds\nread in mdb_load, resulting in reliable denial of service and limited\ninformation disclosure of adjacent heap memory. While no write primitive is\npresent, the disclosure may expose heap metadata and contribute to exploit\nmitigation bypass in multi-stage attacks.\n\n*Evidence:*\n# Execute with crash input\n./mdb_load -T /tmp/lmdb_asan \u003c [crash_input_file]\n\n*Output:*\nmdb_load.c:214:9: runtime error: addition of unsigned offset to\n0x521000000100 overflowed to 0x5210000000ff\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9\n=================================================================\n==1215390==ERROR: AddressSanitizer: heap-buffer-overflow on address\n0x5210000000ff at pc 0xaaaacb6f5bf4 bp 0xffffc2d17d30 sp 0xffffc2d17d28\nREAD of size 1 at 0x5210000000ff thread T0\n    #0 0xaaaacb6f5bf0 in readline\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9\n    #1 0xaaaacb6ed614 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:429:9\n    #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\n0x5210000000ff is located 1 bytes before 4096-byte region\n[0x521000000100,0x521000001100)\nallocated by thread T0 here:\n    #0 0xaaaacb6ad4e4 in malloc\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0x16d4e4) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n    #1 0xaaaacb6ed068 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:354:17\n    #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9 in readline\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:20:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/5"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB v8.3.0 Heap Buffer Underflow in OpenLDAP LMDB mdb_load",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0005",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5",
            "automated": true,
            "contentSha256": "ed64e6da863b4b30592a5d0c84a0f90b3685238143542327775f7db463fe0466",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-30T03:51:57Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-11T07:20:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0005"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}