CVE-2026-114654 MongoDB CVE debrief

Who should care

Defenders of applications using MongoDB C# Driver versions before 3.13.0 should assess exposure and verify remediation to prevent potential data corruption or errors in BSON output.

Why it matters

CVE-2026-114654 is a medium-severity vulnerability in MongoDB C# Driver that allows an unauthenticated party to cause an application to emit and persist malformed binary data. Defenders of applications using affected versions should assess exposure and verify remediation to prevent potential data corruption or errors.

• Potential data corruption or errors in BSON output
• Need to verify remediation by upgrading to MongoDB C# Driver version 3.13.0 or later
• Possible impact on data integrity or application functionality

Technical summary

A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value to bypass integrity checks. This can cause an application to emit and persist malformed binary data, potentially leading to data corruption or errors in BSON output. The vulnerability affects MongoDB C# Driver versions before 3.13.0. Defenders should assess exposure and verify remediation to prevent potential data corruption or errors. The CVE Program and NVD records provide details on the vulnerability.

Defensive priority

Assess exposure and verify remediation for MongoDB C# Driver versions before 3.13.0

Recommended defensive actions

• Assess exposure of MongoDB C# Driver versions before 3.13.0
• Verify remediation by upgrading to MongoDB C# Driver version 3.13.0 or later
• Monitor for potential data corruption or errors in BSON output
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records provide details on the BSON output corruption vulnerability in MongoDB C# Driver. The vulnerability allows an unauthenticated party to supply text that can cause an affected application to emit and persist malformed binary data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.