CVE-2026-114645

Sentinel/Defender KQL

// This vulnerability involves a 32-bit integer wraparound leading to a heap buffer overflow in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code.
// It occurs when an excessively long credential value is supplied in the client's connection configuration, causing an undersized heap buffer allocation.
// This can lead to memory corruption and denial of service of the client application.
// Detection requires monitoring client application behavior for crashes or unusual memory usage patterns related to MongoDB C Driver and Kerberos/SSPI authentication.
// Look for process crashes (e.g., `EventID=1000` in `Application` event log) or abnormal memory allocation/access patterns.
// Specific queries are difficult without more detailed exploit behavior, but general anomaly detection for the affected client processes is recommended.
// Example (conceptual, requires tuning and specific process names):
Event
| where EventID == 1000 // Application crash
| where Source == "Application Error" or Source == "Windows Error Reporting"
| where Details contains "mongo-c-driver" or Details contains "libmongoc" or Details contains "Kerberos" or Details contains "SSPI"
| extend ProcessName = extract(@"Faulting application name: ([^\\]+)", 1, Details)
| extend FaultingModule = extract(@"Faulting module name: ([^\\]+)", 1, Details)
| where ProcessName has "your_client_application.exe" // Replace with actual client application name
| project TimeGenerated, Computer, ProcessName, FaultingModule, Details, EventID

Splunk SPL

# This vulnerability involves a 32-bit integer wraparound leading to a heap buffer overflow in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code.
# It occurs when an excessively long credential value is supplied in the client's connection configuration, causing an undersized heap buffer allocation.
# This can lead to memory corruption and denial of service of the client application.
# Detection requires monitoring client application behavior for crashes or unusual memory usage patterns related to MongoDB C Driver and Kerberos/SSPI authentication.
# Look for process crashes (e.g., `EventCode=1000` in `wineventlog:application`) or abnormal memory allocation/access patterns.
# Specific queries are difficult without more detailed exploit behavior, but general anomaly detection for the affected client processes is recommended.
# Example (conceptual, requires tuning and specific process names):
wineventlog:application EventCode=1000 (Source="Application Error" OR Source="Windows Error Reporting") (mongo-c-driver OR libmongoc OR Kerberos OR SSPI)
| rex field=_raw "Faulting application name: (?<ProcessName>[^\\]+)"
| rex field=_raw "Faulting module name: (?<FaultingModule>[^\\]+)"
| search ProcessName="your_client_application.exe" # Replace with actual client application name
| table _time, host, ProcessName, FaultingModule, _raw, EventCode

Sigma

title: MongoDB C Driver Kerberos SSPI Heap Overflow
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential client application crashes related to MongoDB C Driver's Kerberos/SSPI authentication, indicative of CVE-2026-114645.
references:
  - https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-g9mw-2cwh-6hh9
logsource:
  product: windows
  service: application_event
detection:
  selection:
    EventID: 1000
    Source: 
      - 'Application Error'
      - 'Windows Error Reporting'
    Details|contains:
      - 'mongo-c-driver'
      - 'libmongoc'
      - 'Kerberos'
      - 'SSPI'
    Details|contains|all:
      - 'Faulting application name: your_client_application.exe' # Replace with actual client application name
  condition: selection
fields:
  - ComputerName
  - EventID
  - Source
  - Details
tags:
  - attack.defense_evasion
  - attack.impact
  - cve.2026.114645
  - application.crash
level: high

Elastic ES|QL

// This vulnerability involves a 32-bit integer wraparound leading to a heap buffer overflow in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code.
// It occurs when an excessively long credential value is supplied in the client's connection configuration, causing an undersized heap buffer allocation.
// This can lead to memory corruption and denial of service of the client application.
// Detection requires monitoring client application behavior for crashes or unusual memory usage patterns related to MongoDB C Driver and Kerberos/SSPI authentication.
// Look for process crashes (e.g., `winlog.event_id=1000` in `winlog.event_data.Source` of `Application` event log) or abnormal memory allocation/access patterns.
// Specific queries are difficult without more detailed exploit behavior, but general anomaly detection for the affected client processes is recommended.
// Example (conceptual, requires tuning and specific process names):
FROM winlog.eventdata
WHERE winlog.event_id == 1000
AND (winlog.event_data.Source == "Application Error" OR winlog.event_data.Source == "Windows Error Reporting")
AND (winlog.event_data.Details : "mongo-c-driver" OR winlog.event_data.Details : "libmongoc" OR winlog.event_data.Details : "Kerberos" OR winlog.event_data.Details : "SSPI")
AND winlog.event_data.Details : "Faulting application name: your_client_application.exe" // Replace with actual client application name
| SELECT @timestamp, host.name, winlog.event_data.ProcessName, winlog.event_data.FaultingModule, winlog.event_data.Details, winlog.event_id