The $_internalApplyOplogUpdate aggregation pipeline stage can process a document diff that includes a malformed binary diff, leading to out‑of‑bounds memory access or a server crash. This can cause a denial of service by taking the MongoDB Server down. The weakness is a memory corruption flaw (CWE‑1287).

The vulnerability affects MongoDB Server. No specific version information is provided, so all installations of the product may be vulnerable until a patch is released.

The CVSS score of 7.2 indicates a high severity, and the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. Attackers need to be authenticated and possess permission to run aggregate commands, which limits the threat surface to privileged users. If those privileges are abused, the impact is a service disruption.