CVE-2026-106438: CWE-682: Incorrect Calculation in MongoDB C Driver
Description
CVE-2026-106438 is a vulnerability in the MongoDB C Driver where incorrect calculation occurs during Decimal128 string parsing. The driver improperly accepts certain over-precision inputs with leading zeros instead of rejecting them, resulting in a stored or used numeric value that differs from the original input. This issue can be triggered by an actor supplying a decimal string, including via Extended JSON parsing.
CVSS v4.0
Score 5.1medium
Affected software
MongoDB
C Driver
pkg:github/mongodb/mongo-c-driverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves an incorrect calculation in the Decimal128 string parsing logic of the MongoDB C Driver. Specifically, the driver accepts over-precision decimal strings containing leading zeros rather than rejecting them, causing the application to store or use a numeric value that does not match the supplied text. An attacker able to provide decimal strings to an embedding application can exploit this to cause incorrect numeric values to be processed or stored.
Potential Impact
The impact is that applications embedding the MongoDB C Driver may store or use incorrect numeric values when processing certain decimal strings with over-precision and leading zeros. This can lead to data integrity issues where numeric data does not accurately reflect the intended values. There is no indication of privilege escalation, denial of service, or remote code execution. The CVSS 4.0 score is 5.1 (medium severity), reflecting local attack vector and low complexity.
Mitigation Recommendations
No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the MongoDB vendor advisory for current remediation guidance. Until a fix is available, applications should validate decimal inputs externally before passing them to the MongoDB C Driver to avoid incorrect numeric values.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-10-06T16:40:40.579Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac7feef2cdf04f656318bf7
Added to database: 10/08/2026, 20:37:03 UTC
Last enriched: 10/08/2026, 21:03:59 UTC
Last updated: 10/08/2026, 21:08:22 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.