Is CVE-2026-114654 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114654 being exploited in the wild.

How severe is CVE-2026-114654?

Medium severity, with a CVSS score of 6.5, published 22 October 2026.

Which products and versions are affected?

MongoDB C Driver prior to 3.13.0.

How is CVE-2026-114654 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114654?

Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114654: MongoDB C# Driver BSON numeric type conversion in binary subtype

CVE-2026-114654 · Severity: medium · CVSS 6.5 · Published 2026-10-22

The MongoDB C# Driver contains a flaw in how it handles binary data type metadata when parsing untrusted input. An attacker who can supply specially crafted text to an affected application can cause it to store binary data with mismatched type declarations, leading to data corruption, silent truncation, or bypassing of application-level validation checks. Subsequent readers of this corrupted data may encounter errors or silently interpret the data as shorter than expected.

Technologies: MongoDB C Driver. Vendors: MongoDB.

Quick answers

Is CVE-2026-114654 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114654 being exploited in the wild.
How severe is CVE-2026-114654?: Medium severity, with a CVSS score of 6.5, published 22 October 2026.
Which products and versions are affected?: MongoDB C Driver prior to 3.13.0.
Is there a fix for CVE-2026-114654?: Yes: fixed in 3.13.0 (also on 2.x branch per release notes). Until then: Reject or sanitize binary subtype values to ensure they fall within the valid range of 0 to 255 before processing user-supplied input. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114654 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114654?: Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.13.0 (also on 2.x branch per release notes)

Reject or sanitize binary subtype values to ensure they fall within the valid range of 0 to 255 before processing user-supplied input.

Technical details

The BsonBinarySubType enum lacks range validation, allowing out-of-range values (e.g., 260) to be accepted by BsonBinaryData and JsonReader, then truncated to their low byte during wire encoding via WriteBinarySubType. This produces binary elements that misdeclare their type or length. An unauthenticated attacker supplying malformed textual input can cause an application to emit and persist corrupted binary data that subsequent readers either reject or silently interpret incorrectly.

Affected products

MongoDB C# Driver prior to 3.13.0

Timeline

2026-10-22: disclosed
2026-10-22: patched: v3.13.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.