The vulnerability is an out‑of‑bounds memory read in MongoDB Server's aggregation framework. An authenticated user can trigger the flaw by supplying a specially crafted numeric value in a particular pipeline stage. The unchecked bounds allow the server to read beyond the intended buffer, causing a crash. The only confirmed effect is a denial‑of‑service condition, with the possibility of exposing a limited amount of memory content, but the description does not confirm any tangible data leak.

MongoDB Server is affected. No specific version numbers are disclosed, so all deployments that enable the aggregation framework and allow authenticated users may be vulnerable until a patch is applied.

The CVSS score of 7.1 indicates a high‑risk vulnerability. The EPSS score of less than 1% shows that real‑world exploitation is unlikely but still possible. The issue is not in CISA's Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attacker must authenticate to the database and submit a malicious aggregation pipeline; thus, the attack vector is local or network based with valid credentials. If a threat actor can obtain or guess these credentials, the exploitation would lead to a server crash and optional memory exposure.