The vulnerability arises when the MongoDB server computes an MD5 checksum of a malformed BSON object under specific conditions, leading to a loss of availability. This flaw is an integer overflow attack (CWE‑191) that can result in a denial of service once triggered. The likely attack vector is the injection of a carefully crafted BSON document, which an adversary could supply either via a local interface or over the network if the server accepts externally submitted data.

Affected are MongoDB Server versions 8.2, 8.1, all 8.0 releases before 8.0.21, and all 7.0 releases before 7.0.32. The vulnerability exists in the MongoDB Server product supplied by MongoDB.

The CVSS score is 7.1, indicating a high severity of availability impact. EPSS is not available, so the probability of exploitation cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. Because the flaw manifests during checksum calculation, an attacker who can direct malformed BSON to the server can trigger a denial of service, potentially affecting multiple users or services that rely on the availability of the database.