An authenticated user who has write privileges can create a collection in MongoDB Server and supply crafted storage engine configuration parameters. These parameters override internal storage metadata, leading the server to perform an out‑of‑bounds memory write during collection creation. The immediate consequence is a server crash, providing a denial of service. Because the memory corruption occurs in a privileged process, an attacker could potentially advance beyond a crash to execute arbitrary code. This flaw is a classic out‑of‑bounds write, corresponding to a memory safety weakness.

The vulnerability affects MongoDB Server installations that allow writable users to specify custom storage engine settings when creating collections. No specific product versions are listed, so any deployment of MongoDB Server that permits such configuration overrides is potentially at risk.

The CVSS score of 7.2 indicates a high severity level. While an EPSS score is not available, the need for an authenticated user with write privileges means an attacker must already have some level of access; once that is achieved, exploitation can be immediate. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploits have been reported yet, but the possibility of arbitrary code execution raises the potential for serious future impact. Overall, the risk is moderate‑high, especially in environments where database administrators grant write permissions widely or where external users can influence collection creation.