The vulnerability is a use‑after‑free in MongoDB Server’s server‑side JavaScript engine used during BSON‑to‑array conversion. When an authenticated user with read permissions can execute JavaScript by using operators such as $where or $function, the server may dereference freed memory. This can reveal private data from the mongod process or cause an immediate crash, leading to a denial of service. The flaw is a classic use‑after‑free, described by CWE‑416 and CWE‑787.

Affected systems include all MongoDB Server installations that expose the server‑side JavaScript runtime. Any version that accepts $where or $function calls in queries is vulnerable, regardless of deployment size. Version ranges are not enumerated in the data, so all installations that have not applied the referenced Jira fix are considered at risk.

The CVSS score of 8.7 reflects a high‑severity condition, and the EPSS score of 0.00384 indicates a very low exploitation probability, so the current exploitation likelihood is low. The vulnerability is not listed in CISA’s KEV catalog. The flaw is a classic use‑after‑free, described by CWE‑416 and CWE‑787. To exploit it, an attacker must first authenticate with sufficient privileges to run server‑side JavaScript; the attack vector is thus purely authenticated. Once there, the attacker can trigger the use‑after‑free by submitting a specially crafted BSON document, potentially reading sensitive memory or crashing the server.