The flaw allows an authenticated user having the read role to retrieve portions of uninitialized stack memory when issuing specially crafted filemd5 commands. This results in a leakage of potentially sensitive information from the process memory, violating confidentiality. The weakness is an uninitialized variable issue, classified as CWE-457.

MongoDB database systems that provide the filemd5 command are affected. No specific version range is supplied, so any deployment that supports this command and has not applied an official fix is at risk.

The CVSS score of 7.1 indicates a high severity. Because the attack requires authentication with read privileges, the opportunity is limited to insiders or compromised accounts; an external attacker must first gain authorized access. The EPSS score is not available and the flaw is not listed in CISA KEV, implying no publicly known exploits as of now. Nonetheless, the information disclosure remains a concern for organizations that need to protect their database memory contents.