Packetbeat’s MongoDB protocol parser does not validate array indices correctly, allowing an attacker to send a malicious payload that overflows internal buffers. This flaw can corrupt memory and may provide a path to arbitrary code execution or a crash, depending on the system’s state at the time of the overflow.

Elastic Packetbeat is vulnerable. No specific product versions are listed in the CVE data, so all affected releases prior to a patch should be considered at risk.

The CVSS score of 6.5 indicates a moderate severity. EPSS is below 1%, suggesting that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability requires an attacker to transmit a crafted MongoDB protocol packet to a monitored network interface; therefore the attack vector is likely over the network, possibly from a compromised host within the monitored subnet.