CVE-2026-106438 — Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This p…
Published: 2026-10-08 · CVSS: 5.1 · CVSS 4.0
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7