This vulnerability (CVE-2026-82052) affects MongoDB Server and is classified as CWE-617 (Reachable Assertion). It arises when an authenticated user executes an aggregation pipeline using the $regexFindAll expression with a regex pattern that matches starting in the middle of a multi-code-unit character. This triggers an assertion failure in the server process, causing it to crash. The affected versions explicitly include 7.0, 8.0, and 8.3.0. The CVSS 4.0 score is 7.1, indicating high severity with network attack vector, low attack complexity, no user interaction, and requiring low privileges (authenticated user). No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated user with aggregation pipeline execution privileges to crash the MongoDB server process, resulting in denial of service. There is no indication of data corruption or privilege escalation from the provided information. The impact is limited to service availability disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict aggregation pipeline execution permissions to trusted users only to reduce risk. Monitor MongoDB server stability and consider applying any vendor-recommended workarounds once available.