The vulnerability is a numeric truncation weakness that can cause the BSON library’s JSON parser to read past the end of the supplied buffer, leading to a heap over‑read. An attacker who controls the JSON text handed to the parser can receive memory contents that were not in the input, or the library may silently accept only a portion of the document, or the process may crash. The damage is limited to the host process that uses the driver; it does not affect the MongoDB server or credentials.

The flaw is in the MongoDB C++ Driver, specifically the BSON JSON parsing component. Any application that links against the driver and calls its public JSON parsing interface while supplying very large JSON payloads is vulnerable. The report does not list specific version numbers, so all affected releases prior to the patch are potentially compromised.

The CVSS score of 5.9 indicates medium severity. No EPSS score is available, and the vulnerability is not included in the CISA KEV catalog. The lack of a network entry point means that exploitation requires control over the application’s input or integration with the driver. Because the effect is confined to the process that uses the driver, the risk profile is moderate, but the ability to cause a crash can be disruptive. A well‑formed large JSON document can trigger the over‑read; no special privileges or credentials are needed.