This vulnerability occurs in MongoDB Server when running an aggregation pipeline that employs the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range generates enough documents to fill its exchange buffer, many results are routed to the same consumer, triggering a code path where a full per-consumer buffer is detected but the internal 'high watermark' for that key range is not updated properly. This leads to a reachable assertion condition (CWE-617) that may cause server instability or denial of service.

The vulnerability can cause the MongoDB server to hit a reachable assertion, potentially leading to a denial of service or server crash. The CVSS 4.0 base score is 7.1 (high), indicating significant impact with network attack vector, low attack complexity, no privileges required beyond low, no user interaction, no confidentiality, integrity, or availability impact beyond the assertion failure, but with high vulnerability assessment impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Users should monitor MongoDB's official advisories for updates and apply patches once available.