Progress MarkLogic Server versions 12.x prior to 12.1.0 and 11.x prior to 11.3.7 contain a memory‑safety flaw in the JavaScript engine integration that allows a use‑after‑free condition. The flaw can corrupt memory, leading to unpredictable process failures or sustained instability of the server. The high severity of the flaw is reflected in its CVSS score of 8, indicating a significant threat to availability and system integrity.

The vulnerability affects Progress Software Corporation’s MarkLogic Server. Specifically, all 12.x releases before 12.1.0 and all 11.x releases before 11.3.7 are impacted. No other vendors or product lines are listed.

The CVSS score of 8 signals a high impact, while the EPSS score is currently not available, so the exact likelihood of exploitation is unclear but the potential for abuse remains high. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the execution of malicious JavaScript within a MarkLogic Server context, such as via user‑supplied scripts or query execution. No public exploitation has been reported, but the severity indicates that attackers could achieve denial of service by triggering memory corruption.