An integer wraparound occurs in the BSON JSON parsing routine of the MongoDB C Driver when sizes are 32‑bit. The calculation used for memory allocation can wrap, causing a buffer that is supposed to hold parsed JSON to be freed before a subsequent copy writes to the same region. The stale pointer then receives the copy, leading to a crash and a denial of service. The vulnerability does not provide a remote code execution path and requires only unauthenticated delivery of a large JSON payload.

The flaw appears in the MongoDB C Driver specifically on builds that compile for 32‑bit architectures. No particular version numbers are disclosed, so any older 32‑bit build of the driver that has not been updated to the latest release may be affected. Products that embed the driver in applications that accept external JSON input are at risk.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is not available, and the issue has not been listed in CISA's KEV catalog. Because the attack vector is remote input with no authentication required, an attacker can trigger the denial of service simply by sending a crafted JSON document over the network. Exploitation requires only the ability to reach the application, and no additional privileges or auxiliary exploits are required.