This vulnerability (CVE-2026-9752) affects MongoDB Server versions 7.0.0, 8.0.0, 8.2.0, and 8.3.0. An authorized user can trigger a denial-of-service condition by submitting a query that uses a 2dsphere index on a field storing a GeoJSON GeometryCollection that includes a Polygon with a strict-winding CRS. The system's guard against strict-winding polygons does not check members within GeometryCollections, allowing the unsafe code path to be executed, resulting in a null pointer dereference and server crash. The CVSS 4.0 base score is 7.1, reflecting high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation causes a denial-of-service by crashing the MongoDB server process. This can disrupt availability of the database service for legitimate users. No indication of data corruption or privilege escalation is provided. The attacker must be an authorized user to trigger the issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to authorized users and monitor for suspicious queries involving 2dsphere indexes on GeoJSON GeometryCollections. Avoid using strict-winding polygons in indexed fields.