An unsafe cast in MongoDB's query planner causes a segmentation fault when a query targets a collection that has an invalid compound wildcard index. The resulting crash terminates the server process, denying service to all clients. This error falls under CWE‑704, a type conversion error, and is triggered only when the database receives a query from an authenticated user.

MongoDB Server by MongoDB Inc. The CVE does not specify affected version numbers, so any deployment that supports the vulnerable query planner code is potentially impacted.

The vulnerability has a CVSS score of 7.1, indicating high impact, but an EPSS score of less than 1% shows a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. Attackers must be authorized to run queries against a collection with an invalid compound wildcard index, so the attack surface is limited to insider or credential‑compromise scenarios. Once exploited, the server crashes, leading to downtime until it is restarted or patched.