MongoDB C# Driver CVE-2026-114654

The affected application must parse attacker-supplied textual input into BSON binary elements - via the JSON reader's BinData, HexData, or legacy $type syntax, or by constructing a BsonBinaryData - using a binary subtype value outside the valid 0-255 range, and must then encode and persist that data. Exploitation therefore requires a code path that accepts untrusted text and writes it back out as BSON; it is limited to driver versions 2.0.0 up to but not including 3.13.0, and the realistic impact is data corruption (malformed/under-length binary elements) that later readers reject or silently truncate, not code execution, disclosure, or authentication bypass.

This is a moderate, integrity-focused issue rather than a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 and indicates a remote, low-complexity, unauthenticated reach, but impact is deliberately narrow: VC:N (no confidentiality loss), VI:L and VA:L (limited integrity and availability effects), with no scope change. The real-world effect per the vendor is BSON output corruption - malformed binary elements that downstream readers reject or misread - not code execution, data disclosure, or access-control bypass. No EPSS score, KEV listing, or POC reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the vuln.today Decision label is 'this_month', consistent with a bug to patch on a normal cycle rather than act_now/emergency. One signal conflicts with the rest: the input Tag 'Authentication Bypass' is inconsistent with CWE-681 (incorrect numeric conversion) and with the description/Jira CSHARP-6166, which describe an integrity-check bypass on binary subtypes, not any authentication bypass - treat that tag as mislabeled, not as evidence of an auth-level flaw.

An unauthenticated user submits textual input (e.g., JSON with BinData, HexData, or legacy $type, or data that becomes a BsonBinaryData) carrying a binary subtype value outside the valid 0-255 range to an application built on an affected MongoDB C

Driver. On encoding, the out-of-range subtype is narrowed to a smaller wire representation, so the application emits and persists binary elements that misdeclare their type or length. No public exploit code is referenced; the attack requires only that the app parse attacker-supplied text and write the result back as BSON.