CVE-2026-84963: CWE-681: Incorrect Conversion between Numeric Types in MongoDB C Driver

This vulnerability involves an incorrect conversion between numeric types in the JSON parsing component of the MongoDB C Driver's BSON library. When processing unusually large text values, the parsing operation may silently shorten the text or omit the corresponding field entirely, while still reporting success and no error. An unauthenticated attacker who can supply input to an application using this component may cause the application to store data that differs from what was originally submitted, potentially leading to unintended data alteration. The affected versions are MongoDB C Driver versions >=1.10.0 and <1.30.9, and >=2.0.0 and <2.5.2.

The vulnerability can cause data integrity issues by allowing an attacker to submit input that results in truncated or omitted data fields without triggering errors. This may lead to applications holding incorrect or incomplete data, which could affect application behavior or data reliability. There is no indication of privilege escalation or remote code execution. The vulnerability can be exploited by unauthenticated parties who can supply input to the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications using the affected MongoDB C Driver versions should carefully validate and sanitize input to mitigate risks of data alteration. Monitor vendor communications for patches or updates addressing this issue.