The library provides explicit decryption that, when encountering an unrecognized encrypted payload, returns the raw bytes unchanged instead of signaling a decryption failure. This flaw means an attacker who can alter stored encrypted data can cause the application to treat the corrupted blob as a legitimate plaintext value, potentially leading to incorrect application behavior or data corruption. The weakness arises from improper error handling during decryption (CWE-354).

This vulnerability affects the MongoDB libmongocrypt component. No specific version range is listed, so all releases of MongoDB libmongocrypt that have not yet absorbed the fix are potentially impacted.

The CVSS score of 5.3 indicates a medium risk. The EPSS score is not available, so the public exploitation probability is unclear, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to modify encrypted fields, such as a database writer, an unauthorized server, or a network intermediary. The likely attack vector is through compromised write access or tampering with data in transit; if an attacker succeeds, the affected application could process the tampered payload as plaintext, leading to data integrity issues.