A high-severity memory corruption vulnerability in MongoDB Server, triggered by malicious BSON data, could lead to denial of service or unintended system behavior.

This is a heap-based buffer overflow (CWE-122) caused by insufficient validation of externally sourced BSON data during aggregation pipeline processing. This vulnerability can be triggered when compute mode is enabled on a standalone mongod instance.

The vulnerability poses a severe risk to service availability and system stability. An attacker providing crafted BSON data could cause the MongoDB service to crash or potentially achieve arbitrary code execution through heap memory corruption. Given the critical role of database servers, this vulnerability could result in significant downtime or data compromise, justifying its high CVSS score of 8.1.

Immediate Action: Upgrade MongoDB Server to the versions specified by the vendor that incorporate the security fix (e.g., 7.0.39, 8.0.28, 8.2.12, 8.3.7).

Proactive Monitoring: Monitor MongoDB error logs and system resource usage for unexpected process crashes or high memory consumption that may indicate exploitation attempts.

Compensating Controls: Ensure that the MongoDB instance is not exposed to the public internet and restrict access to authorized application servers only.

Public Exploit Available: No

Database administrators must prioritize applying the provided patches to their MongoDB environments. Restricting network access to the database server remains a vital defense-in-depth measure against remote exploitation attempts.