MongoDB Server implements a slot‑based execution (SBE) engine that stores intermediate hash tables in memory. When an authenticated user with write privileges submits a crafted aggregation query that uses the $lookup operator, the engine may spill an in‑memory hash table to disk, triggering a double‑free or use‑after‑free memory bug. The resulting memory corruption can cause the server to crash or behave unpredictably, potentially leading to a denial‑of‑service event. The vulnerability is identified as CWE‑415, a double free issue.

MongoDB Inc’s MongoDB Server is the impacted product. No specific version numbers are listed, so any release that implements the SBE engine and supports the $lookup aggregation syntax may be vulnerable.

The CVSS score of 6.1 indicates a moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation in the field. The vulnerability is not present in the CISA KEV catalog. Exploitation requires an authenticated account with write permissions to run the malicious aggregation query, limiting the attack surface to privileged users or compromised accounts. While the description does not state arbitrary code execution, the memory corruption could lead to crashes or other unintended behavior that disrupts service availability.