AIKIDO-2025-10402

TL;DR

A double-free vulnerability exists in mongodb.libmongocrypt where several parsing functions incorrectly perform cleanup when processing malformed input. Because callers are expected to invoke the corresponding cleanup routine regardless of whether parsing succeeds or fails, a parse error can result in the same memory being freed twice. An attacker able to supply crafted input to an affected parsing function may trigger a denial of service through an application crash. Users should upgrade to a fixed version.