A flaw in the MongoDB C# Driver’s BSON deserializer can return data that was processed previously on the same thread. When an attacker supplies a specially crafted BSON document, the driver may expose leftover bytes from unrelated requests, leaking limited information about other users or sessions. This weakness results in information disclosure without requiring authentication or elevated privileges within the application.

MongoDB C# Driver, particularly versions prior to the 3.13.0 release that contains the fix referenced in the advisory, is impacted. Applications that use the driver to deserialize BSON data from untrusted sources are affected.

The CVSS score of 6.3 classifies the vulnerability as moderate severity. Because no authentication or special privilege is required, an unauthenticated actor can exploit it by submitting crafted BSON data to any endpoint that invokes the driver’s deserialization logic. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, indicating that widespread exploitation has not yet been observed. However, the ability to leak residual data makes the vulnerability valuable to attackers seeking to gain insight into other requests or users.