CVE Feed

    Dashboard / CVE / CVE-2026-106438

    CVE-2026-106438

    An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

    Published:Oct 8, 2026
    Last Modified:Oct 27, 2026
    EPS:Oct 8, 2026
    EPSS Score:0.00108
    CVSS Score:4

    Affected Products

    Vendor
    Mongodb
    Product
    C Driver

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-682 Incorrect Calculation

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-128 Integer Attacks
    CAPEC-129 Pointer Manipulation

    Related CVEs

    CVE-2026-120954 (CVSS 6.3) — A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wrapar…
    CVE-2026-120955 (CVSS 8.7) — The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under …
    CVE-2026-120956 (CVSS 7.1) — The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a que…
    CVE-2026-120684 (CVSS 6) — A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialize…
    CVE-2026-120678 (CVSS 8.7) — A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client libra…
    CVE-2026-114645 (CVSS 5.7) — A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause…
    CVE-2026-106437 (CVSS 5.9) — The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON mi…
    CVE-2026-106431 (CVSS 5.9) — An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediate…
    CVE-2026-106428 (CVSS 6.3) — An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyon…
    CVE-2026-96746 (CVSS 8.3) — An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High