MongoDB Go Driver EUVD-2026-95165

Requires that the consuming application feed attacker-controllable BSON bytes into the MongoDB Go Driver's validation or value-access path (the integer overflow is in BSON value-length handling), AND that the application process is 'unprotected' - i.e., it does not wrap this parsing in its own Go panic recovery. Exploitation is materially limited by two factors: (1) the driver's own server-monitoring path already includes panic recovery, so that path degrades only to a server-selection failure rather than a process crash; and (2) applications that recover from panics or never expose BSON parsing to untrusted input are not affected. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the AT:P metric reflects that a crafted malformed document and a vulnerable application code path are both prerequisites.

This is a genuine but bounded availability risk, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw whose only impact is availability (VA:H; VC:N/VI:N), consistent with CWE-190 integer overflow causing a Go runtime panic - there is no code execution or data exposure. The single most important signal is AT:P (Attack Requirements: Present): exploitation is conditional, not guaranteed against any exposed endpoint, because the description states the panic only crashes an 'unprotected application process' - i.e., an application that itself accesses/validates attacker-supplied BSON without its own panic recovery. MongoDB notes the driver's server-monitoring path already has panic recovery and is limited to server-selection failure, which further narrows the blast radius. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or public weaponization. Net: treat as a routine-to-moderate priority dependency patch - real and unauthenticated, but availability-only and dependent on how the consuming application handles untrusted BSON. Note a mild signal tension to verify: the 8.2 'High' score is driven almost entirely by VA:H + AV:N, while AT:P and the application-dependent trigger mean real-world exploitability is lower than the headline number suggests.

A Go service uses the MongoDB Go Driver to parse or validate BSON that originates from an untrusted source (e.g., a client upload, a message queue, or a proxied document). A remote, unauthenticated attacker submits a malformed BSON document crafted to overflow a value-length field, causing an integer overflow and a runtime panic that crashes the unprotected process and denies service. No public exploit code was identified at time of analysis, so exploitation would require an attacker to craft the malformed BSON themselves.