Read the docs
TI-2026-69714 Aliases CVE-2026-106438

Silent Decimal128 value corruption in MongoDB C Driver

Priority LOW 22CWE-682Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The MongoDB C Driver from 1.4.0 before 1.30.13 and from 2.0.0 before 2.5.6 contains an incorrect calculation (CWE-682) in its Decimal128 string parsing. Certain over-precision inputs with leading zeros are accepted instead of rejected, producing a value that differs from the supplied text. An actor who can supply a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Fix Fixed C Driver (MongoDB): 1.30.13, 2.5.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBC Driver1.4.0 to before 1.30.13; 2.0.0 to before 2.5.61.30.13, 2.5.6Patch availableCNA
  • C Driver VendorMongoDB Affected 1.4.0 to before 1.30.13; 2.0.0 to before 2.5.6 Fixed in 1.30.13, 2.5.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*1.4.0 to before 1.30.13; 2.0.0 to before 2.5.6VulnerableMongoDB
  • cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:* Versions 1.4.0 to before 1.30.13; 2.0.0 to before 2.5.6 Vulnerable ·MongoDB

Remediation

Upgrade the MongoDB C Driver to version 1.30.13 or later in the 1.x branch, or to version 2.5.6 or later in the 2.x branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA C Driver (MongoDB) Fixed in 1.30.13, 2.5.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MongoDB C Driver 1.30.13, 2.5.6

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-69713 Out-of-bounds memory access in MongoDB C Driver BSON buffersPriority LOW 25
    • TI-2026-69710 One-byte heap buffer overflow in MongoDB C Driver BSON bulk writerPriority LOW 25
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-106438
  2. 2026-10-10 Affected versions changed · Red Hat
  3. 2026-10-10 CVSS score added · Red Hat
  4. 2026-10-27 CVSS score added · NVD

References

Advisory 1

  • TI-2026-62966 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream CVSS 4.0CRITICAL 9.2
  • TI-2026-05870 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow CVSS 4.0HIGH 8.6
  • TI-2026-62968 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() CVSS 4.0MEDIUM 6.9
  • TI-2024-07001 Accessing Untrusted Directory May Allow Local Privilege Escalation CVSS 3.1HIGH 7.8
  • TI-2026-58387 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client CVSS 4.0HIGH 8.2
  • TI-2023-00414 MongoDB client C Driver may infinitely loop when validating certain BSON input data CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences