MongoDB Server CVE-2025-11979

Requires an authenticated account (PR:L) that holds privileges to execute DDL operations (such as creating or dropping collections/indexes) against the target database, and that account must issue such a DDL command concurrently with an active query workload to win the race that triggers the use-after-free/over-read. Exploitation is further limited by the vendor's 'under some conditions' qualifier (indicating timing/race dependence that is not deterministic), by the requirement for valid credentials and DDL authorization (not exploitable by fully unauthenticated users), and by version scope - only MongoDB Server 7.0 before 7.0.25, 8.0 before 8.0.15, and 8.2.0 are affected. Impact is confined to availability (process crash); there is no confidentiality or integrity effect.

This is a medium-severity authenticated denial-of-service issue, and the available signals are mutually consistent in pointing to a real-but-not-urgent risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) shows network reach but requires low-level privileges (PR:L) and yields availability-only impact (C:N/I:N/A:H) - there is no data disclosure or code execution, only a server crash. EPSS is low at 0.27% (18th percentile), there is no CISA KEV listing, and no public exploit was identified, so exploitation status is 'no public exploit identified at time of analysis.' One internal tension worth flagging: the vendor rated AC:L, but the description says the crash occurs 'under some conditions' by issuing a DDL operation 'while queries are being issued,' which describes a concurrency/race condition that is typically timing-dependent and not reliably triggerable - this argues for higher attack complexity than AC:L suggests. A second discrepancy: CWE-416 (Use After Free) and the 'Use After Free'/'Memory Corruption' tags are assigned, yet the description characterizes the fault as a 'buffer over-read' (more aligned with CWE-125); verify the exact memory-safety root cause with MongoDB. Net: a legitimate patch-worthy availability bug, but not a drop-everything priority - it needs an authenticated actor who can run DDL and can only crash the service, not compromise data.

An authenticated user (or a compromised application account) with privileges to run DDL operations issues a schema-changing command (e.g., collection/index create or drop) concurrently with an ongoing query workload, triggering a buffer over-read / use-after-free that crashes the mongod process and causes a denial of service. Because exploitation depends on racing a DDL against live queries 'under some conditions,' repeated attempts may be needed before the crash reliably occurs. No public exploit code was identified at the time of analysis.