The vulnerability is an out-of-bounds write occurring in the BSON-to-JSON conversion helpers of the MongoDB C Driver when a binary field is base64 encoded and the output is truncated by a caller-specified length limit. This flaw can allow an attacker to overwrite a few bytes beyond the allocated heap buffer, potentially altering adjacent data structures in memory. The impact is memory corruption, which could lead to program crashes or unpredictable behaviour but does not directly provide remote code execution. The weakness is identified as CWE-787.

The affected product is the MongoDB C Driver. No specific versions are listed, so any version of the driver that contains the vulnerable conversion helper may be impacted. Applications that link against the driver library and process BSON documents may be exposed if they use the truncating JSON output helper.

The CVSS score is 6.3, reflecting medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an actor who can supply arbitrary BSON documents to the application that uses the driver; no special privileges on the application are required for the attacker, but the attacker must influence the data fed into the driver. Because the flaw results in an out-of-bounds write rather than a privilege escalation or arbitrary code execution, the risk is primarily of memory corruption and potential denial-of-service rather than direct compromise. The likely attack vector is through the application that processes external data, leveraging the driver’s conversion helper.