Standalone mongod instances with compute mode enabled are vulnerable because externally supplied BSON data in aggregation pipelines is not properly validated, allowing memory corruption. This flaw can lead to the mongod process crashing or behaving unpredictably, exposing the system to denial‑of‑service conditions. The weakness is a classic out‑of‑bounds write reflected in CWE‑122.

The vulnerability applies to MongoDB Server running in standalone mode when compute mode is explicitly enabled at startup. No specific version numbers are listed in the advisory, so any release configured in this manner is potentially affected.

The CVSS score of 9.2 indicates high severity. EPSS score of < 1%, indicating a very low likelihood of exploitation, and the issue is not listed in CISA KEV, so current exploitation data is unknown. The likely attack vector is remote, as an attacker would need to submit malicious BSON data via an aggregation pipeline to a mongod instance that has compute mode enabled. If such access is possible, the attacker could trigger memory corruption and cause a denial of service or other unintended behavior.