This vulnerability arises from an incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library, allowing an excessively large text value to be silently truncated or omitted. The parsing operation reports success and no error, so an application may retain data that does not match the original input. An attacker who can supply input to the application may thus cause unintended data alteration, compromising data integrity.

Affected systems include the MongoDB C Driver used by applications that process JSON input. The prompt does not specify patched versions, so any currently deployed MongoDB C Driver is potentially vulnerable. Users should verify the driver version and apply the latest patch released by MongoDB when it becomes available.

The CVSS score of 6.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers with unauthenticated access to the JSON input source can exploit the flaw; implementation wise, an attacker requires the ability to inject a large JSON string into the parser, which may be achieved via network requests or local input channels. The impact is limited to data integrity; there is no remote code execution or privilege escalation.