The MongoDB C# Driver writes GeoJSON extra members without validating whether their names collide with reserved GeoJSON members such as type and coordinates. When an application inserts user‑supplied field names into these extras, documents can contain duplicate geometry fields. The server and the driver then resolve different values for the same record, and records containing these duplicates may become unreadable through the driver, causing errors or crashes in application code that reads them.

MongoDB C# Driver. No specific affected driver versions are listed; the vulnerability is present in versions prior to the device’s patch release.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by supplying crafted GeoJSON data that introduces duplicate geometry field names, typically through any API or interface that accepts user input for GeoJSON objects. This can be performed remotely by an external actor who exploits the application’s lack of validation.