The vulnerability is a use‑after‑free in MongoDB Server’s server‑side JavaScript engine used during BSON‑to‑array conversion. When an authenticated user with read permissions can execute JavaScript by using operators such as $where or $function, the server may dereference freed memory. This can reveal private data from the mongod process or cause an immediate crash, leading to a denial of service. The flaw is a classic use‑after‑free (CWE‑787).

Affected systems include all MongoDB Server installations that expose the server‑side JavaScript runtime. Any version that accepts $where or $function calls in queries is vulnerable, regardless of deployment size. Version ranges are not enumerated in the data, so all installations that have not applied the referenced Jira fix are considered at risk.

The CVSS score of 8.7 reflects a high‑severity condition, though the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. To exploit it, an attacker must first authenticate with sufficient privileges to run server‑side JavaScript; the attack vector is thus purely authenticated. Once there, the attacker can trigger the use‑after‑free by submitting a specially crafted BSON document, potentially reading sensitive memory or crashing the server.