## Summary
MongoDB Server query execution engine has a flaw affecting certain queries against time-series collections. An authenticated user with read/write privileges may trigger use of an internal reference after the underlying memory is freed, potentially causing a server crash or disclosure of freed memory contents in query results.
## Technical Details
- Root condition: use-after-free in the query execution engine when running certain queries against time-series collections.
- Affected behavior: internal reference is used after the underlying memory has been freed.
- Outcomes:
- Server crash
- Disclosure of freed memory contents within query results
- Related issue reference: SERVER-130247 (“Treat Decimal128 values as potentially invalid when preparing to yield or detach cursor”).
## Affected
- Product: MongoDB Server
- Component: Query Execution
- Operating system: ALL
- Affects versions: not specified in the provided reference content (Jira shows Affects Version/s: None), but backport requests are listed for v9.0, v8.3, and v8.2.
- Prerequisites:
- Authenticated access
- User has read and write privileges
## Impact
- Availability: Denial of service via server crash (A:H).
- Confidentiality: potential exposure of freed memory contents in query results (C:L).
- Privileges required: PR:L (low/limited privileges) with UI:N (no user interaction).
## Mitigation
1. Apply the vendor’s fix/backport for the relevant MongoDB Server versions mentioned in the tracking issue (v9.0, v8.3, v8.2) once available.
2. Restrict and review accounts with read/write privileges, since exploitation requires authenticated read/write access.
3. Monitor for abnormal query patterns against time-series collections and for unexpected MongoDB process crashes/restarts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CWE-416