A use-after-free vulnerability exists in MongoDB’s SBE implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. When a specific aggregation pipeline is executed by an authenticated user with readWrite privileges, the accumulator can retain a dangling pointer to memory that has been freed. Dereferencing this stale pointer during serialization can trigger a heap out-of-bounds read that may expose adjacent heap contents and crash the mongod server.

The affected product is MongoDB Server, including all releases that support SBE and the $setWindowFields operator. No exact version list is publicly documented in the advisory, but any version containing the SBE window accumulator component is potentially vulnerable. Organizations running MongoDB Server should verify whether their deployment uses $setWindowFields in $setWindowFields pipelines and assess the presence of this code path.

With a CVSS score of 7.1, the vulnerability presents moderate severity, and a very low EPSS score (<1%) indicates it is unlikely to be widely exploited. Because an attacker must be authenticated with readWrite access, the risk is limited to systems where users have elevated privileges. The vulnerability is not listed in the CISA KEV catalog, further suggesting a low but present threat profile. Nonetheless, it is recommended to mitigate the issue promptly.