CVE-2026-106438 Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver
Attackers can cause data corruption by providing malformed decimal strings to applications using the MongoDB C Driver, leading to incorrect numeric values being stored.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106438?
CVE-2026-106438 is a medium-severity vulnerability in MongoDB C Driver, published on 8 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.
Weakness: CWE-682
Which versions are affected by CVE-2026-106438?
It affects 1 product.
Products include Mongodb C Driver.
How do I fix CVE-2026-106438?
Upgrade to a fixed version.
Is CVE-2026-106438 being exploited?
There is no known exploitation of CVE-2026-106438 in the wild and no public exploit code.
Other vulnerabilities in MongoDB C Driver
- CVE-2026-93393 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream
- CVE-2026-6691 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow
- CVE-2026-84964 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client
- CVE-2024-7553 Accessing Untrusted Directory May Allow Local Privilege Escalation
- CVE-2026-93395 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
Sources
Also known as DEBIAN-CVE-2026-106438, UBUNTU-CVE-2026-106438.