{
  "cveId": "CVE-2026-81523",
  "url": "https://patchblox.com/security/cve/CVE-2026-81523",
  "summary": "CVE-2026-81523 is fixed in libmongocrypt on 1 platform, first by DEBIAN-CVE-2026-81523, released September 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libmongocrypt: A missing input-validation issue in MongoDB libmongocrypt\u0027s automatic-encryption context setup allows a caller-suppli...",
  "description": "A missing input-validation issue in MongoDB libmongocrypt\u0027s automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.",
  "published": "2026-08-27T20:18:50Z",
  "severity": "",
  "epss": 0.00098,
  "epssPercentile": 0.00753,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libmongocrypt",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.13.2-1\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-81523",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-81523",
      "released": "2026-09-03T01:35:34Z"
    },
    {
      "platform": "linux",
      "product": "libmongocrypt",
      "release": "Debian 14",
      "fixedVersion": "1.20.3-1",
      "fix": "DEBIAN-CVE-2026-81523",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-81523",
      "released": "2026-09-03T01:35:34Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}