CVE-2026-114654: CWE-681: Incorrect Conversion between Numeric Types in MongoDB C# Driver

This vulnerability arises from a numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver. An attacker supplying an out-of-range binary subtype value via untrusted textual input can bypass binary-element integrity checks. When the data is encoded, it is narrowed to a smaller wire representation, resulting in binary elements that misdeclare their type or length. This malformed data can cause errors or silent misinterpretation by subsequent readers. The flaw affects versions >=2.0.0 and <3.13.0 of the MongoDB C# Driver.

An unauthenticated attacker able to supply text parsed by an affected application can cause it to emit and persist malformed binary data. This may lead to errors or silent misinterpretation by subsequent readers of the data. The vulnerability does not require privileges or user interaction and has a medium severity score (CVSS 6.9). There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, applications should carefully validate and sanitize untrusted textual input that is parsed into BSON binary elements to prevent malformed data emission.