A user who has only read‑only privileges can craft an aggregation pipeline that uses the $linearFill window function with a deliberately malformed sortBy expression. The insufficient validation of the sort specification in the server causes the mongod process to terminate abnormally, depriving the system of database services. This flaw is identified as CWE‑476.

MongoDB Server is affected. All installations of the MongoDB Server that incorporate the $linearFill window function could be vulnerable, as no specific version numbers are provided in the advisory.

The CVSS score of 7.1 places this issue in the moderate to high severity range. The EPSS score is reported as less than 1 %, indicating a very low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker with read‑only access to a managed database can submit a malicious aggregation request without needing to bypass authentication. The threat is most acute in environments where read‑only credentials are exposed to untrusted clients or where internal users can send arbitrary aggregation pipelines.