The vulnerability arises when an authenticated user executes a specific data type conversion within MongoDB's aggregation framework. This operation consumes disproportionate amounts of memory, causing the operating system to terminate the mongod process under memory pressure. The result is a denial of service that disrupts database availability for applications relying on the server.

MongoDB Server instances are affected. No version information is supplied, so all installations that have not yet applied the appropriate vendor patch could be vulnerable.

The CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1% suggests exploitation is unlikely. The vulnerability requires authenticated write access and the ability to run aggregation queries, meaning compromised credentials or privileged accounts are needed. Once these prerequisites are met, an attacker can trigger memory exhaustion and force the server to crash, leading to downtime until service recovery.