The vulnerability stems from an arithmetic wraparound during the calculation of element counts when parsing a specialized binary vector type in BSON. On 32‑bit builds, an attacker can supply an oversized length that overflows a 32‑bit counter, causing the library to report success while only processing a small subset of the data. The flaw does not trigger memory corruption or disclose sensitive information; its impact is limited to data integrity, meaning future application logic may see incorrect data size values.

MongoDB’s C Driver library is the affected product, specifically the BSON component handling the packed‑bit vector views. The issue appears on 32‑bit platforms where the word size is 32 bits; there are currently no specified version ranges, so vulnerable installations may include any 32‑bit build of the driver that has not yet been patched.

Based on the description, it is inferred that the likely attack vector is delivering crafted BSON data to an application that unconditionally parses external input. With a CVSS score of 6.3 the flaw is considered moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no current evidence of widespread exploitation. Attackers only need to supply crafted BSON data that the application will unconditionally parse, which could be achieved remotely if the target service accepts external BSON input. While the flaw does not allow memory corruption or data disclosure, it can produce incorrect data sizes that may lead to logic errors or inconsistent behavior.