critical Known exploitedREV. 01
CVE-2025-14847MongoDB Server — uninitialised heap read from compressed headers
Mismatched length fields in compressed protocol headers let an unauthenticated client read uninitialised heap memory out of MongoDB Server, exposing whatever happened to be sitting there. Fixed across the 5.0 to 8.2 branches.
Read the risk
THE VITAL STATS- CVSS score
- 8.7/ 10 CVSS v4.0
- EPSS probability
- 83% Likelihood of exploitation
- Attack complexity
- Low Conditions needed to exploit
- Known exploited
- Yes — CISA KEV
- CVE published
- 2025-12-19
- Added to KEV
- 2025-12-29
- Exploit published
- Yes
- Confidence
- high
- Kill chain
- collection
- MITRE ATT&CK
- —
- Severity
- critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needsNetwork access to the database port; no credentials needed.
Fixed inMongoDB Server 7.0.28, MongoDB Server 8.0.17, MongoDB Server 8.2.3, MongoDB Server 6.0.27, MongoDB Server 5.0.32
Behind the card
5 REFERENCES- 01CVE recordNVD recordnvd.nist.gov
- 02CISACISA Known Exploited Vulnerabilities catalogcisa.gov
- 03Vendor advisoryjira.mongodb.orgjira.mongodb.org
- 04Exploitvicarius.iovicarius.io
- 05Exploitvicarius.iovicarius.io
Field-level provenanceTRACE THE SOURCES +
Which source supports each field, when it was retrieved, and who extracted it.
| Fields | Source | Retrieved | Extractor | Confidence |
|---|---|---|---|---|
| cvss, exploitation.attack_complexity, exploitation.exploit_available, references, published_at | nvd.nist.gov | 2026-09-24 | scrty-crds-pipeline/0.1 | high |
| exploitation.known_exploited, exploitation.kev_added | cisa.gov | 2026-09-24 | scrty-crds-pipeline/0.1 | high |
| epss | api.first.org | 2026-09-24 | scrty-crds-pipeline/0.1 | high |
| title, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites | nvd.nist.gov | 2026-09-24 | claude-code | high |
Printing history
THE RECORD- r1Initial base card
First printing. This card has not been reprinted since publication.