MongoDB C Driver CVE-2026-84963

The target application must use the MongoDB C Driver's JSON-to-BSON parsing component to process input that originates, at least partially, from an external source. The attacker must control at least one numeric text field in that input and supply a value with an unusually large text representation that exceeds the BSON numeric type's valid range. No authentication is required based on PR:N in the CVSS 4.0 vector, but the attacker must have network reachability to an application-layer endpoint that passes their input through the affected driver code path. Exploitation is bounded by AT:P - a specific oversized input is required - and by the limited integrity impact (VI:L): only field truncation or silent omission is possible, not arbitrary value injection or overwrite. Applications that independently range-validate or schema-enforce numeric fields before driver ingestion are not exploitable via this path.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) scores 6.3 (Medium). AT:P (Attack Requirements: Present) acknowledges that exploitation requires supplying an unusually large numeric text value, but this is a trivially reproducible condition for any attacker who controls input; it does not meaningfully raise the bar beyond a basic crafted payload. VI:L (Low integrity impact) accurately reflects the narrow scope - field-level truncation or omission rather than arbitrary data injection or system compromise. VC:N confirms there is no confidentiality exposure. No EPSS score, KEV listing, or public POC is provided, indicating no observed in-the-wild exploitation. Real-world risk escalates significantly in applications where numeric fields govern security-relevant decisions (financial thresholds, permission levels, rate limits, safety bounds), where silent truncation can produce logical inconsistencies that downstream logic exploits without triggering any observable error state. The missing exact affected and patched version numbers from the JIRA reference (CDRIVER-6407) make precise exposure assessment difficult for defenders.

An attacker with access to an API endpoint that accepts JSON input and stores parsed results via the MongoDB C Driver submits a payload containing a numeric field whose text value exceeds the BSON target type's representable range - for example, an integer string far beyond 64-bit bounds. The driver silently truncates or drops the field and returns success; the application stores the corrupted record and proceeds normally. If the affected field governs a business logic decision such as a credit balance, permission flag, or rate-limit counter, the attacker may exploit the mismatch between the submitted and stored value to bypass controls or corrupt account state.