A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out‑of‑bounds heap read via a crafted aggregation pipeline. The vulnerability requires an authenticated user and bypasses wire‑level BSON validation. When the malformed CodeWScope element is decompressed, the unchecked size value is used in pointer arithmetic, which can cause a server crash or lead to disclosure of adjacent heap memory contents. The flaw is categorized as a runtime memory corruption weakness (CWE‑125).

The affected product is MongoDB Server. No specific version list is provided, so any deployment running a vulnerable branch of MongoDB Server may be impacted until a vendor patch is applied.

MongoDB assigns this vulnerability a CVSS score of 7.1, indicating a high severity level. The EPSS score is 0.00241 (<1%), indicating a low but non‑zero exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is the authenticated use of an aggregation pipeline that contains a forged CodeWScope element; once the payload is processed by the server, the out‑of‑bounds read can be triggered. The impact includes potential denial of service or data leakage, making the risk significant for environments where untrusted clients can construct custom aggregation queries.