Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

MongoDB C# driver can create malformed binary data

CVE-2026-114654 · published 13 days ago
Summary

The C# driver for MongoDB can turn specially crafted text into corrupted binary records. If an unauthenticated source supplies this input, the application may store data that later causes reading errors or incorrect processing. Upgrade to the latest driver version and validate all external text before it reaches the driver.

What to do
  • Update mongodb c# driver to version 3.13.0 or later.
Affected software
VendorProductAffected versions
mongodb c# driver < 3.13.0
Original advisory text
BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-681Incorrect Conversion between Numeric Types
Timeline
Published22 Oct 2026
Updated4 Nov 2026
First seen22 Oct 2026
Sources
CVE-2026-114654 · NVD
CVE-2026-114654 · MITRE
CVE-2026-114654 · OSV
GHSA-5h2q-6c9r-7x25 · GHSA
Track software like this
Free during beta