The vulnerability is a type confusion flaw in the MongoDB Server query subsystem that can cause the server process to terminate unexpectedly when it receives a specially crafted query filter. An authenticated user possessing read privileges can trigger this crash, leading to an interruption of database services. The flaw is mapped to CWE-843, indicating a type mismatch that results in invalid memory handling and application failure. Since the impact is limited to service interruption, there is no direct path to code execution, disclosure of data, or privilege escalation.

The affected product is MongoDB Server. No specific version ranges are listed in the available data, so any installation that includes the query subsystem and that can accept maliciously formatted read‑privileged queries is potentially vulnerable. Administrators should verify the version of their MongoDB installation against vendor release notes to confirm whether the fix has been applied.

The CVSS score of 7.1 places the issue in the medium severity range. The EPSS value of less than 1% indicates a very low probability of exploitation under current conditions, and the vulnerability is not cataloged in CISA’s KEV. The likely attack vector is through an authenticated application layer where the attacker can send a malicious query; the requirement for read privileges limits the threat to users who already have some level of access to the database. Because the issue leads only to a denial of service, the immediate damage is limited to availability disruptions, but it can still impact business operations during downtimes. Overall, the risk is moderate but warrants a timely patch to eliminate the crash potential.