An authenticated MongoDB user with standard read/write privileges can send a specially crafted aggregation command that forces the libmongocrypt library to allocate an excessively large amount of memory. The uncontrolled allocation triggers an out‑of‑memory condition, causing the mongod process to terminate. This results in a denial‑of‑service attack on the database instance and is an example of CWE‑190 where improper bounds checking leads to resource exhaustion.

MongoDB Server is affected. No specific version information is listed, so all publicly released builds that include the libmongocrypt component should be considered potentially vulnerable until a patch is confirmed.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated account with read/write access, so an attacker must first gain legitimate credentials or compromise an existing user to trigger the denial of service.