CVE-2026-114651
MEDIUM 6.3A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 33rd percentile
Impact if exploited
6.3CVSS 4.0 · MEDIUM
- ConfidentialityLow
- IntegrityNone
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ⚠Requirements: Specific conditions must be present
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-908: : Use of Uninitialized Resource
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
References and research data (JSON)
All CVSS metrics
- MEDIUM 6.3 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - MEDIUM 4 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - MEDIUM 6.3 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - MEDIUM 4 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
References
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108322 EUVD · EUVD-2026-108322
Technical & other
- https://jira.mongodb.org/browse/CSHARP-6170CVE record · mongodb · Updated 2026-10-22T20:38:23.091Z
NVD · CVE-2026-114651 · Updated 2026-10-23T19:45:03.547 - https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0CVE record · mongodb · Updated 2026-10-22T20:38:23.091Z
NVD · CVE-2026-114651 · Updated 2026-10-23T19:45:03.547 - https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-f8xm-c88f-wq46CVE record · mongodb · Updated 2026-10-22T20:38:23.091Z
NVD · CVE-2026-114651 · Updated 2026-10-23T19:45:03.547