The vulnerability occurs when MongoDB’s server‑side JavaScript engine mishandles DBPointer objects during BSON serialization, causing data that reflects parts of the server’s internal memory to be embedded in responses sent to a client. This flaw can lead to unintended disclosure of server memory contents, potentially revealing sensitive information to an attacker who can trigger the serialization, but the exact nature of the leaked data is not specified by the vendor.

All MongoDB Server deployments that have server‑side JavaScript execution enabled are vulnerable. No specific product versions are stated, so any instance where the feature is active should be evaluated for the presence of the flaw.

The CVSS score of 7.1 denotes a high impact on confidentiality, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need the capability to execute JavaScript on the server, which implies privileged or compromised access; this prerequisite is an inferred assumption based on the fact that the flaw is limited to server‑side JavaScript. If that access exists, the attacker could cause the memory disclosure and obtain the sensitive data.