A numeric‑type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out‑of‑range binary subtype value supplied through untrusted textual input to bypass the library's binary‑element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. This can cause malformed BSON to be emitted and persisted; subsequent readers either reject the data with an error or silently interpret it as shorter than validated, potentially leading to data loss or a denial of service if the application crashes.

MongoDB C# Driver, a component of MongoDB. Versions prior to the patched release (as documented in the driver’s release notes, e.g., 3.13.0) are affected. The vulnerability is introduced by the driver library that handles BSON encoding and decoding.

The CVSS score of 6.9 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated party able to supply untrusted text that is parsed by an affected application, leading to corrupted BSON output. Exploit conditions do not require special privileges; the impact is limited to data integrity and potential service disruption from malformed data processing.