CVE-2026-114646

Name of the Vulnerable Software and Affected Versions MongoDB C# Driver (affected versions not specified)

Description A data-validation flaw exists in the BSON handling and binary serialization path. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver fails to verify if the declared size quantity matches the actual data provided, copying it to the wire unchanged. An unauthenticated party providing binary content can insert additional elements into or remove existing elements from the database command issued by the application. This may lead to unauthorized modification of stored data and disclosure of information beyond the intended scope, limited by the application's database privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.