The vulnerability allows an authenticated user with read-only privileges to exfiltrate uninitialized stack memory by issuing specially-crafted filemd5 commands. This flaw is a form of memory disclosure, enabling an attacker to glean internal state information that could contain sensitive details. The weakness is characterized by CWE‑457 and CWE‑908.

MongoDB Server produced by MongoDB Inc is affected. The issue applies to releases starting with version 8.3.0 alpha0 through alpha3 and rc1, and to all other builds indicated by the general MongoDB product CPE. The vulnerability is documented in the MongoDB issue tracker as SERVER‑119317.

The CVSS score of 7.1 indicates a high severity impact, yet the EPSS score of under 1% suggests limited exploitation likelihood. The attacker must be authenticated with at least a read role to use the filemd5 command, so the vulnerability is not exploitable by anonymous users. The flaw is not listed in the CISA KEV catalog, implying no known widespread exploitation. Nevertheless, the potential for leaking internal data warrants prompt remediation.