The flaw is a use‑after‑free bug triggered during geospatial validation in MongoDB Server, where an internal reference is accessed after the memory that holds it has been released. This results in an unhandled exception that crashes the server, effectively denying service to any client until the process is restarted. The weakness falls under CWE‑416, a classic memory‑management defect that undermines program stability.

All releases of MongoDB Server that contain the buggy geospatial validation are potentially impacted. No specific version range is listed in the CNA data, so any deployment of MongoDB Server that has not applied a fix for SERVER‑130117 should be considered vulnerable.

The CVSS score of 6.0 classifies the issue as medium severity; the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and it is not currently listed in the CISA KEV catalog. However, the attack requires an authenticated user with write privileges and the ability to issue concurrent operations against a collection that uses a geospatial validator that triggers the bug. In a scenario where an attacker gains such privileges—through legitimate credentials or credential compromise—the exploit can be performed locally or remotely over the network. The impact is a server crash, which may be mitigated by automatic recovery scripts but still represents a substantial availability risk.