CVE-2026-114654

The record

A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.

Affected packages

Related vulnerabilities

• CVE-2026-119340 Tesseract is an open source OCR engine. CWE-681
• CVE-2026-118769 Botan is a C++ cryptography library. CWE-681
• CVE-2026-114118 Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in… CWE-681
• CVE-2026-12670 IBM MQ could allow an authenticated attacker to cause a denial of service through a… CWE-681
• CVE-2026-106432 The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value… CWE-681
• CVE-2026-98095 In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't cast… CWE-681
• CVE-2026-98049 In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the… CWE-681
• CVE-2026-88387 LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in… CWE-681