The bson_validate function in the MongoDB C Driver may prematurely return success on specific inputs, which causes malformed BSON documents—including those containing invalid UTF-8 sequences—to bypass validation. This flaw is an input validation weakness that allows malicious or corrupt data to be silently accepted and subsequently processed by applications, potentially leading to crashes, undefined behavior, or other errors when the data is used.

MongoDB Inc. C Driver is affected for all releases before version 1.30.5, as well as the 2.0.0 and 2.0.1 releases. Any application that relies on these driver versions and validates untrusted BSON through bson_validate is at risk.

The CVSS score of 5.3 categorizes the issue as moderate. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting the likelihood of widespread exploitation is unclear. However, the defect may be exploited by attackers who can supply crafted BSON payloads to applications that ingest external data—such as network services or file import functionality—thereby forcing the application to process corrupted input without proper validation.