CVE-2026-114654: BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Applications using the affected BSON handling library are exposed when they parse textual input supplied by an untrusted party and later encode and persist the resulting BSON. The attacker does not need authentication.
What must an attacker be able to do?
They must be able to provide textual input that the application parses through the affected BSON handling path. The supplied input must contain an out-of-range binary subtype value that is subsequently encoded.
What operational symptoms could indicate exploitation?
The application may emit and persist malformed BSON binary elements. Subsequent readers may reject those elements with an error or silently interpret them as shorter than the data that was previously validated.