Progress MarkLogic Server versions 12.x prior to 12.1.0 suffer from an out‑of‑bounds read in specific query‑processing functions. An attacker with valid credentials could trigger the flaw, potentially causing the server to become unstable and exposing fragments of process memory. The vulnerability is a classic CWE‑125 out‑of‑bounds read that can lead to partial disclosure of sensitive data and availability disruption.

The affected product is Progress Software Corporation’s MarkLogic Server. All releases in the 12.x series before patch 12.1.0 are vulnerable; later releases are not impacted.

The CVSS score of 7.1 indicates a medium severity vulnerability. No EPSS score is available, and the bug is not yet listed in the CISA KEV catalog, suggesting no confirmed exploits in the wild. Attackers need authenticated access, so compromise is limited to users who have legitimate credentials or have circumvented authentication controls. Once authenticated, the attacker can trigger the out‑of‑bounds read to induce instability or glean limited memory contents. The risk is moderate, with a potential impact on availability and confidentiality for attacker‑controlled accounts.