The vulnerability arises from an incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver. When an application supplies an extremely large, non‑terminated field name to the builder, the numeric conversion may interpret the length value incorrectly, causing a read outside the intended buffer and terminating the calling process. The result is a denial‑of‑service condition; the attacker does not need authentication but must deliver the oversized name in a specific way.

This defect affects the MongoDB C++ Driver. No specific driver versions are enumerated in the advisory, so any deployment of the driver that includes the vulnerable component is potentially exposed. The issue is tied to the builder API used to construct BSON documents in C++ applications that interact with MongoDB.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no known exploited samples at this time. Because no authentication is required, the main barrier to exploitation is the need to craft the oversized, non‑terminated field name. If an attacker can inject such input into an application that uses the vulnerable driver, they can cause the application to crash. The attack vector is therefore dependent on the application's ability to accept arbitrary field names from an untrusted source.