Vulnerabilities

CVE-2026-82076 is an integer overflow (CWE-190) in the query planning component of MongoDB Server that allows an authenticated user to bypass an internal resource limit. A user holding ordinary database-level read/write privileges can submit a specially crafted query that drives unbounded memory consumption during query planning, exhausting the host's memory and terminating the server process. The impact is a high-severity denial of service affecting every database served by the affected node, with no confidentiality or integrity impact per the CVSS 4.0 vector. All MongoDB Server deployments that grant read/write database access to untrusted or application-controlled accounts are affected. There is no known public proof of concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so exploitation has not yet been observed.

Do: Upgrade MongoDB Server to the fixed release identified in MongoDB's security advisory for CVE-2026-82076, since no specific version ranges are available in this data. In the interim, audit and minimize the set of accounts granted database-level read/write privileges, apply least privilege, and avoid exposing mongod nodes to untrusted networks. With no public PoC and low EPSS, this can be handled in standard patch cycles unless untrusted users hold write access to your clusters.

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

CVE-2026-81532 is a buffer overflow (CWE-121) in the MongoDB Connector for BI ODBC driver: cursor names in positioned-cursor SQL statements are not length-checked before the driver copies them into a fixed-length internal buffer while constructing a diagnostic message. An attacker needs only low privileges — any user who can submit SQL through an application that uses this ODBC driver — and triggers the flaw by sending a positioned-cursor statement with an over-long cursor name. The resulting overwrite of adjacent memory can crash the hosting application process and may also allow unintended code to run within it. Only deployments that use the Connector for BI's ODBC driver — typically BI and analytics integrations that issue SQL against MongoDB over ODBC — are affected; the data provided names no other MongoDB products or version ranges. No proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no active exploitation is known at this time.

Do: Inventory whether any applications or BI-tool integrations connect to MongoDB through the Connector for BI ODBC driver, and upgrade the driver to a patched release once MongoDB publishes fixed versions (no version numbers are available in the data at hand). In the meantime, restrict SQL submission to trusted low-privilege users and cap or validate cursor-name lengths in application code, and alert on crashes of processes hosting the driver.

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.