The vulnerability involves a heap‑buffer‑over‑read in the _mongoc_http_send function of the MongoDB C driver. A non‑null‑terminated buffer is passed to strstr, causing the function to read past the allocated memory. This memory access error results in an application crash. The primary impact is a denial of service, as the targeted process terminates unexpectedly. The weakness corresponds to out‑of‑bounds array access and improper string termination.

Affected systems include MongoDB Inc's MongoDB C driver. No specific version range is listed in the advisory, so any instance of the driver that contains the _mongoc_http_send implementation is potentially vulnerable until a patch is applied.

The CVSS score is 2, indicating low severity, and the EPSS score is below 1%, suggesting that exploitation is unlikely at present. It is not listed in the CISA KEV catalog. The likely attack vector is remote, where a compromised third‑party cloud server or a man‑in‑the‑middle attacker can send a crafted HTTP response to trigger the crash. Once executed, the crash leads to a denial of service without providing confidentiality or integrity impact.