This vulnerability is more dangerous than its CVSS 7.1 suggests. The mechanism is a time-delayed persistence attack: malformed geometry is written without triggering validation failures, and the out-of-bounds memory access only occurs during later query processing when legitimate users run $geoWithin, $geoIntersects, or similar geospatial operators. An attacker with brief write access plants a logic bomb that detonates under normal operational load — not in their own session, but in every subsequent query against that collection.
The threat model shifts because the attacker doesn't need sustained access or presence at detonation. A compromised service account with write privileges plants the malformed geometry and disappears. The crash happens hours or days later when a completely different user — perhaps a logistics analyst running a proximity search — triggers the out-of-bounds access. Your incident response won't find an active session to revoke; you'll be auditing data written potentially weeks ago by an account that may no longer exist.
Service account credential sprawl amplifies this. MongoDB deployments frequently grant broad write permissions because developers need flexible data access for geospatial features, logistics tracking, and mobile applications. The 'authenticated user with write privileges' CVSS prerequisite understates the likelihood of compromise in microservice architectures where fifteen services share overlapping collection permissions.
The operational reality is worse than patching. If the malformed geometry survives mongorestore, you've got a persistent denial-of-service vector in your backups. The payload doesn't expire — it sits in the collection until physically cleaned, and every query against that collection triggers the same crash. In multi-tenant deployments, verify whether one tenant's planted geometry can destabilize the mongod process serving other tenants; if geometry parsing accesses shared memory, the boundary may not hold at the query layer.
Check your MongoDB deployments for geospatial feature usage. Audit service accounts with write access to any collection that could contain location data. Treat any pre-existing geometry data as untrusted — it may have arrived via migration, restore, or a buggy ORM layer. The security failure is in the architectural decision to defer validation to query time, and that decision was made for developer productivity, not for defense.