The vulnerability resides in the BSON library of the MongoDB C# Driver, where an unavoidable resource consumption flaw in the handling of a specific BSON value type leads to unbounded symbol interning. When an application deserializes untrusted content, the library keeps a reference to the derived data for the duration of the process, allowing the attacker to force continuous memory allocation without any limit. The result is exhaustion of the host application's memory, causing the process to become unavailable. No compromise of confidentiality or integrity is possible, and the server component is not affected.

The affected product is the MongoDB C# Driver. The fix is available in driver version 3.13.0 and later. No other vendors or products are cited, and the issue does not impact the MongoDB server.

The CVSS score of 8.2 indicates a high severity. The EPSS score is currently not reported, so the likelihood of exploitation is uncertain, but the vulnerability is listed as not in the CISA KEV catalog. The attack vector is inferred to be remote, unauthenticated, through the deserialization of malicious BSON or JSON payloads sent to an application that uses the vulnerable driver.