The vulnerability is a null pointer dereference that occurs when an authenticated user runs $rankFusion or $scoreFusion on a view with an empty pipeline. The result is a crash of the mongod process, leading to a denial of service that can affect all clients connected to the database instance. No direct data disclosure or tampering is possible, but the loss of service can disrupt business operations.

Affected versions are MongoDB Server 8.2 versions earlier than 8.2.7. The issue tracks to MongoDB Inc. and can be mitigated by upgrading to the supported 8.2.7 release or later.

With a CVSS score of 7.1, the severity is moderate, and the scheduler does not indicate an exploit probability (EPSS not available). The vulnerability is not listed in KEV but could still be exploited by users that have legitimate access to the database. The attack requires only authentication and the ability to invoke the aggregation framework; it does not rely on network exposure, so the primary vector is local or internal access.