The bson_validate function in the MongoDB C Driver may prematurely return success on specific inputs, causing malformed BSON documents—including those containing invalid UTF-8 sequences—to bypass validation. This input validation weakness allows malicious or corrupt data to be silently accepted and subsequently processed by applications, potentially resulting in crashes, undefined behavior, or other errors when the data is used.

MongoDB Inc. C Driver is affected for all releases before version 1.30.5, as well as the 2.0.0 and 2.0.1 releases. Any application that relies on these driver versions and validates untrusted BSON through bson_validate is at risk.

The CVSS score of 5.3 categorizes the issue as moderate. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector involves supplying crafted BSON payloads to applications that ingest external data—such as network services or file import functionality—thereby forcing the application to process corrupted input without proper validation.