A use‑after‑free flaw exists in the Field‑Level Encryption component that parses client queries to identify encrypted fields. When a query contains positional projections, the analysis routine mistakenly frees a memory object too early, leaving dangling pointers. If an attacker can control the shape of the query, the freed memory may be reused in a way that corrupts data structures or allows arbitrary code execution, potentially compromising the entire database process.

MongoDB Server 7.0 versions prior to 7.0.34, 8.0 versions prior to 8.0.23, 8.2 versions prior to 8.2.9, and 8.3 versions prior to 8.3.2 are affected. The vulnerability is present in the mongocryptd component that runs alongside the server and in the client‑side crypt_shared library that performs query analysis. All of these versions are now superseded by the mentioned release thresholds.

The CVSS score of 6.1 reflects a moderate severity risk. EPSS is not available, so the exploitation probability remains uncertain, and the issue is currently not listed in CISA’s KEV catalog. An attacker would need to send a specially crafted FLE query from a client that interacts with mongocryptd or crypt_shared. Successful exploitation could result in memory corruption, leading either to remote code execution or a server crash that disrupts availability. Given the absence of a publicly known exploit, the risk is proportionally tied to the vulnerability’s inherent severity.