This vulnerability is a use‑after‑free flaw in MongoDB’s legacy ExpressionContext handling within the $lookup and $graphLookup aggregation operators. If successfully triggered, the flaw can corrupt memory that may lead to a crash or arbitrary code execution. The flaw is described as a "use‑after‑free" bug, which corresponds to CWE‑416.

Affected only the MongoDB Server product from MongoDB Inc. The vulnerability is limited to sharded cluster deployments and requires an authenticated user. No specific vulnerable version numbers are supplied in the data, so affected releases are not identified.

The CVSS score of 8.7 indicates a high severity level. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector can be inferred as requiring access to a sharded cluster and the ability to submit a specially crafted aggregation pipeline as an authenticated user with the read role. The fix would need to be applied to eliminate the use‑after‑free condition. In the absence of a publicly available exploit, the risk remains primarily theoretical but significant given the high CVSS rating.