C Driver CVE-2026-6231

The CVSS 5.3 score with network-accessible attack vector (AV:N), low complexity (AC:L), and low privilege requirement (PR:L) indicates this is moderately exploitable; however, the impact assessment shows only low integrity impact (VI:L) with no confidentiality or availability impact. The EPSS score of 0.48 (approximately 48% exploitation probability) places this in the moderate range-above-average risk but not critically urgent. The tag 'Authentication Bypass' is somewhat misleading: this is not a classic authentication bypass but rather an input validation bypass that requires an authenticated attacker to send crafted BSON data to an application using a vulnerable driver version. The practical risk depends heavily on the application's trust model-if an app validates BSON only via this function and accepts the result without secondary checks, integrity corruption becomes possible. However, many applications may have defense-in-depth measures (schema validation, application-level checks) that mitigate the real-world impact. This is a genuine vulnerability that should be patched, but is not an emergency-level issue.

An authenticated application user or internal service connected to a MongoDB database via the vulnerable C Driver sends a specially crafted BSON document with an invalid UTF-8 sequence or structural anomaly. The bson_validate function incorrectly returns success due to the early-exit bug, causing the driver to pass the malformed BSON to the application. The application, trusting the validation result, processes the invalid data, which may corrupt internal state, trigger incorrect query results, or cause subtle data integrity issues in downstream operations.