Digital shields protecting against urgent cybersecurity exploits and breaches.

Daily Cybersecurity News - December 28, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

December 28, 2025 3:15 PM 4 min read

MongoBleed CVE 2025 14847 Exploited in the Wild: Everything You Need to Know

High

Executive Summary

CVE-2025-14847, also known as MongoBleed, is a high-severity unauthenticated information leak vulnerability in MongoDB that allows remote attackers to extract fragments of sensitive in-memory data. Exploitation has been observed in the wild, making it critical for organizations to patch urgently.

Vulnerability Details

Affected Product: MongoDB Server versions 3.6.x through 8.2.x (specifically, versions prior to 4.4.30, 5.0.32, 6.0.27, 7.0.28, 8.0.17, and 8.2.3)
Identifier: CVE-2025-14847
CVSS Score: 8.7 (High)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Urgent patching is required due to the high severity and active exploitation.
Attack Vector: An unauthenticated, remote attacker can send a specially crafted zlib-compressed message to trigger the vulnerability. This causes the server to return uninitialized heap memory.
Ease of Exploit: The vulnerability has low attack complexity and can be exploited without user interaction. Public exploit code is available.

Action Plan

Immediate Action: Upgrade MongoDB to patched versions 4.4.30, 5.0.32, 6.0.27, 7.0.28, 8.0.17, or 8.2.3 or later.
Workaround: Disable zlib compression by starting `mongod` or `mongos` with a configuration that omits zlib. Other options are snappy and zstd.
Detection: Monitor MongoDB command error logs for spikes in "Slow query" messages containing "incorrect BSON length in element with field name". Also, look for CPU and memory contention from malformed requests and large data requests from unauthenticated IPs.

Relevant professional terms

Heap Memory: A region of a computer's memory that is dynamically allocated and used by programs to store variables and data structures during runtime.
Unauthenticated Vulnerability: A security flaw that attackers can exploit without needing to log into the system, often leading to significant impact due to their broad reach.

Source: Wiz Blog

CVE-2025-14104: Util-linux Heap Buffer Overread in setpwnam()

Medium

Executive Summary

CVE-2025-14104 describes a heap buffer overread vulnerability in util-linux's setpwnam() function when processing 256-byte usernames, affecting SUID login utilities. This vulnerability can lead to a local denial-of-service and potential information disclosure. The status is that information has been published regarding this vulnerability.

Vulnerability Details

Affected Product: Util-linux
Identifier: CVE-2025-14104
CVSS Score: 6.1 (Medium)
Exploitation Status: Not specified.

Risk & Impact

Triage: Prioritize inventory, vendor updates, and conservative temporary mitigations where risk is greatest.
Attack Vector: Local; requires local system access. The vulnerability is triggered when processing 256-byte usernames with the `setpwnam()` function.
Ease of Exploit: Low attack complexity; exploits can be performed without significant complexity or special conditions.

Action Plan

Immediate Action: Apply vendor updates.
Workaround: Implement temporary mitigations where risk is greatest.
Detection: Monitor for unusual activity related to SUID login utilities and password database writes.

Relevant professional terms

Heap Buffer Overread: A type of buffer overflow where the program reads beyond the boundaries of an allocated buffer in the heap, potentially leading to information disclosure or crashes.
SUID (Set User ID): A permission setting on executable files that allows them to be executed with the privileges of the file's owner, rather than the user who runs the file. This is often used for utilities that require elevated privileges to perform certain tasks.

Source: Microsoft MSRC

Rainbow Six Siege: Infrastructure Breach

Executive Summary

Ubisoft’s Rainbow Six Siege suffered a critical infrastructure breach, resulting in the injection of $339 trillion in in-game currency and the hijacking of administrative moderation tools.

Attack Overview

Attack Path: Exploitation of a Rainbow Six Siege service and a MongoDB vulnerability dubbed "MongoBleed" (CVE-2025-14847).

Impact Assessment

Data Stolen: Potential exfiltration of source code and user data is under investigation.
Operational Impact: Game and marketplace shutdown, rollback of transactions, and disruption of gameplay.

Strategic Takeaway

The breach highlights the need for robust security measures, including access controls, API security, and continuous monitoring, to protect online platforms from unauthorized access and manipulation.

Relevant professional terms

MongoBleed: A vulnerability (CVE-2025-14847) that allows unauthenticated remote attackers to leak memory from exposed MongoDB instances.
Exploit: A piece of code or a sequence of commands that takes advantage of a vulnerability in a system or software to cause unintended or unanticipated behavior.

Source: Bleeping Computer

Access Now's Digital Security Helpline

Executive Summary

Access Now's Digital Security Helpline provides real-time, direct technical assistance and advice to civil society groups, activists, journalists, and human rights defenders who are at risk of digital security threats. It helps these individuals and organizations improve their digital security practices and provides rapid-response emergency assistance if they are already under attack.

Key Features

Provides rapid response for digital security incidents.
Offers personalized recommendations and instruction for digital security issues.
Assists in assessing risks and creating security strategies.
Provides guidance and educational materials on security practices.

Use Case (The "So What?")

Red teams can leverage the insights and methodologies of the Digital Security Helpline to simulate real-world attacks on high-risk individuals and organizations, identifying vulnerabilities in their digital defenses. Blue teams can use the Helpline's resources to educate users, implement stronger security measures, and develop incident response plans, enhancing their ability to protect against government spyware and other advanced threats.

Availability

The Digital Security Helpline is a free-of-charge service available 24/7 in multiple languages.

Relevant Terms

Government Spyware: Malware used by governments to gather information, often by intercepting communications from a target's computer.
Digital Security: The practice of protecting digital information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

Source: TechCrunch