A data‑validation flaw in the MongoDB C# Driver allows an attacker to craft a raw or lazy BSON document whose declared length does not match the actual bytes. When the driver forwards this data to the database, it writes the bytes verbatim, potentially adding or removing elements from the command the application intends to run. This can lead to unauthorized changes to stored data and leakage of data that should have remained confidential, all performed without the attacker having database credentials. The weakness is a classic length‑consistency error classified as CWE‑130.

The MongoDB C# Driver is affected. No specific version range is provided, but any release that still includes the vulnerable BSON handling routines will be at risk.

The CVSS score of 6.9 indicates moderate severity. The attacker requires the ability to supply binary BSON to the application, which is possible when the application accepts arbitrary binary payloads from untrusted sources. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog. The exploitation path is straightforward for an unauthenticated actor who can inject crafted BSON, making the risk a moderate but realistic concern for exposed services.