This vulnerability is a use-after-free (CWE-416) in the Field-Level Encryption query analysis component of MongoDB Server, impacting client-side components mongocryptd and crypt_shared. Exploitation requires control over the structure of a client's FLE-related query. Affected versions include MongoDB Server 7.0 before 7.0.34, 8.0 before 8.0.23, 8.2 before 8.2.9, and 8.3 before 8.3.2. The CVSS 4.0 vector indicates network attack vector with high attack complexity and partial privileges required. The vulnerability could lead to memory corruption issues due to use-after-free conditions. No vendor advisory or patch links are available at this time.

Successful exploitation could result in memory corruption on the client side when processing FLE-related queries, potentially leading to crashes or other undefined behavior. The impact is limited to client-side components mongocryptd and crypt_shared and requires attacker control over query structure. There are no known exploits in the wild, and the severity is rated medium based on CVSS 4.0 score of 6.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted or malformed FLE-related queries and monitor MongoDB's official channels for updates. No specific temporary mitigations or workarounds are documented at this time.