This vulnerability arises from type confusion (CWE-843) in MongoDB Server's handling of DBPointer objects during BSON serialization within its server-side JavaScript engine. Improper processing can cause internal memory contents to be included in data returned to clients, resulting in unintended information disclosure. The affected versions explicitly include 7.0, 8.0, 8.2.0, and 8.3.0. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, and no privileges or user interaction required. The vulnerability does not affect cloud-hosted MongoDB services. No vendor advisory or patch is currently available, and no known exploits have been reported.

Successful exploitation can lead to unintended disclosure of internal process memory contents to clients, potentially exposing sensitive information. This impacts MongoDB Server deployments that utilize server-side JavaScript. There is no indication of privilege escalation, denial of service, or integrity impact. The vulnerability is exploitable remotely without user interaction and requires low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting or disabling server-side JavaScript execution if feasible to reduce exposure. Monitor official MongoDB channels for updates and apply patches promptly once available.