MongoDB C Driver EUVD-2026-116140

Exploitation requires that the vulnerable application be a 32-bit build (platform word size of 32 bits) of the MongoDB C driver's BSON library AND that it parse untrusted BSON data containing a binary vector data type with an attacker-supplied oversized element-count value that triggers the arithmetic wraparound. No authentication or user interaction is required beyond inducing the application to parse the data (PR:N/UI:N). Key limiting factors that reduce real-world risk: 64-bit builds of the same library are not affected; the impact is confined to silent data truncation/integrity divergence (no code execution, no memory corruption, no information disclosure); and the CVSS AC:H/AT:P metrics reflect the dependence on the 32-bit build condition and a specifically crafted oversized value.

This is a genuinely moderate, not high-priority, issue and the signals are internally consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3, but the real-risk profile is narrower than that number suggests: the only impact is a low integrity effect (VI:L) with no confidentiality, availability, memory-safety, or scope impact, and both AC:H and AT:P signal that exploitation is conditional rather than trivial. The condition is concrete - only 32-bit (platform-word-size) builds are affected, so 64-bit deployments are not vulnerable at all. There is no CISA KEV listing, no EPSS score was provided, and no public exploit or PoC reference is present (the only reference is a MongoDB Jira tracking ticket, not exploit code), so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a real-but-non-urgent data-integrity bug. Net: this is a correctness/data-integrity defect worth patching on a normal cycle, not a high-CVSS-but-weaponized emergency. One input inconsistency to note: the tag set includes 'Information Disclosure', which directly contradicts the description's explicit statement that no information is disclosed - treat the integrity-only characterization as authoritative.

An application built as a 32-bit binary and using the MongoDB C driver's BSON library parses attacker-supplied BSON containing a binary vector element whose declared size is oversized. The arithmetic wraparound causes the library to report success while silently processing only a small fraction of the elements, so the application acts on truncated data that disagrees with byte-oriented accessors and with 64-bit builds. No public exploit code is known; this is a data-integrity corruption scenario rather than code execution.