MongoDB C# Driver CVE-2026-114643

Exploitation requires an application built on the MongoDB C

Driver (versions 1.8.0 up to before 3.13.0) that serializes GeoJSON objects containing extra members AND routes user-supplied field names into those extra members. The supplied name must collide with a reserved GeoJSON member such as 'type' or 'coordinates'; absent this specific usage pattern the flaw is not reachable. PR:L reflects that the attacker needs application-level access to submit the field data. Limiting factors: only affects code paths that write GeoJSON extra members from untrusted names, standard GeoJSON usage without attacker-controlled extra-member names is unaffected, and the impact is confined to data correctness and driver-side readability rather than code execution or data theft.

This is a medium-severity data-integrity issue (CVSS 4.0 base 5.3), not a high-impact remote code execution or disclosure flaw, and the available signals are internally consistent on that point. The vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reach with low attack complexity but requires some privilege (PR:L) - the attacker must be able to feed field names through an application that uses the driver. Impact is limited to integrity (VI:L) and availability (VA:L); confidentiality is explicitly VC:N, so despite the input 'Information Disclosure' tag this is not a confidentiality breach. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit or PoC reference is present - only the vendor release and the CSHARP-6179 Jira ticket. The vuln.today decision label is 'this_month', consistent with a real but non-urgent fix rather than an emergency. Net: a legitimate correctness/integrity bug worth patching on a normal cycle, not a widespread-exploitation priority. Note the conflict to verify: the 'Information Disclosure' categorization contradicts the CVSS VC:N impact.

An application using the MongoDB C

Driver serializes GeoJSON geometry and places user-supplied strings into GeoJSON extra members. An attacker (an application user able to control those field names) submits a name that collides with a reserved GeoJSON member such as 'type' or 'coordinates', causing the driver to write a document with duplicate geometry fields so the server and the driver later resolve different values for the same record, and some affected records become unreadable through the driver. No public exploit code or PoC is identified at time of analysis.