This vulnerability in MongoDB Server's aggregation framework allows an authenticated user to cause an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. The out-of-bounds read can lead to a server crash (denial of service) and potentially leak a limited amount of memory data. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact. There is no information about affected versions or available patches in the provided data.

Successful exploitation can cause the MongoDB server to crash, resulting in denial of service. Additionally, a limited amount of memory contents may be exposed, which could lead to information disclosure. The vulnerability requires an authenticated user and does not impact integrity. The overall impact is high due to availability disruption and limited confidentiality exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to trusted authenticated users only and consider limiting use of the affected aggregation pipeline stage if possible.