MongoDB C Driver CVE-2026-106438

Exploitation requires an application built on the MongoDB C Driver to parse an attacker-supplied Decimal128 string - explicitly including via Extended JSON parsing - where the input is an over-precision decimal containing leading zeros that the driver wrongly accepts rather than rejects. The limiting factors are: the embedding application must actually accept external decimal/Extended JSON input from an untrusted actor and then store or act on the parsed numeric value; applications that never expose Decimal128 parsing to attacker-controlled data are unaffected. Impact is confined to incorrect numeric values (data integrity) with no code execution, data disclosure, or denial of service.

This is a genuine but low-to-moderate priority issue, not a high-urgency flaw. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) scores 5.1 (medium) and, critically, caps impact at integrity-only (VI:L) with no confidentiality (VC:N), no availability (VA:N), and no subsequent-system impact - consistent with CWE-682 (Incorrect Calculation), where a parser silently produces a wrong Decimal128 value rather than crashing or leaking data. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is data-correctness corruption (wrong numeric value stored or used) rather than system compromise. One conflict to note: the input Tag 'Information Disclosure' contradicts the CVSS vector, which explicitly sets VC:N (no confidentiality impact) and only VI:L - this is a data-integrity bug, not an information-disclosure one. Also note the vector asserts AV:L (local) while the description says the malicious decimal string can arrive 'through Extended JSON parsing,' which in many embedding applications is network-reachable input - verify the real attack surface against how the consuming application ingests decimal strings.

An application built on the MongoDB C Driver parses a Decimal128 value from attacker-controlled input (e.g., an Extended JSON document submitted via an API). The attacker supplies an over-precision decimal string padded with leading zeros that the driver accepts instead of rejecting, so the stored or computed number silently differs from the supplied text - potentially skewing a financial amount, quota, or comparison. No public exploit code is identified; exploitation requires only the ability to feed a decimal string to the embedding application.