In fle_crypto.cpp:encryptData(), the IV buffer is initialized to a length of MONGOCRYPT_IV_LEN, but not written with cryptographically-secure random data, before being passed to do_encrypt().