Vulnerabilities

CVE-2026-88032 is a use-after-free (CWE-416) in the reactive client-side encryption component of the MongoDB Java Driver, in which native resources can be freed while a still-running encrypted operation is using them. The issue is reachable only when the application uses a reactive encryption configuration that retrieves KMS credentials on demand, and it is triggered when an attacker or component able to cause such an in-flight encrypted operation to be cancelled does so. The result is an availability-only impact: the hosting application process can terminate, with no confidentiality or integrity loss (CVSS 4.0 vector shows VA:H with VC:N/VI:N, scored 8.2 High). Affected parties are JVM application developers embedding the MongoDB Java Driver with reactive streams plus client-side encryption and on-demand KMS credential retrieval; MongoDB deployments that do not use client-side encryption, or that use the sync/standard async drivers, are not affected. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

Do: Audit JVM applications for use of the MongoDB Java Driver's reactive streams API with client-side encryption configured to fetch KMS credentials on demand; if present, upgrade to the fixed driver version identified in MongoDB's security advisory (version numbers not provided in the available data). Until patched, limit which callers can cancel in-flight encrypted operations, and monitor MongoDB's advisory for version and mitigation details.

CVE-2026-82076 is an integer overflow (CWE-190) in the query planning component of MongoDB Server that allows an authenticated user to bypass an internal resource limit. A user holding ordinary database-level read/write privileges can submit a specially crafted query that drives unbounded memory consumption during query planning, exhausting the host's memory and terminating the server process. The impact is a high-severity denial of service affecting every database served by the affected node, with no confidentiality or integrity impact per the CVSS 4.0 vector. All MongoDB Server deployments that grant read/write database access to untrusted or application-controlled accounts are affected. There is no known public proof of concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so exploitation has not yet been observed.

Do: Upgrade MongoDB Server to the fixed release identified in MongoDB's security advisory for CVE-2026-82076, since no specific version ranges are available in this data. In the interim, audit and minimize the set of accounts granted database-level read/write privileges, apply least privilege, and avoid exposing mongod nodes to untrusted networks. With no public PoC and low EPSS, this can be handled in standard patch cycles unless untrusted users hold write access to your clusters.

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

CVE-2026-81532 is a buffer overflow (CWE-121) in the MongoDB Connector for BI ODBC driver: cursor names in positioned-cursor SQL statements are not length-checked before the driver copies them into a fixed-length internal buffer while constructing a diagnostic message. An attacker needs only low privileges — any user who can submit SQL through an application that uses this ODBC driver — and triggers the flaw by sending a positioned-cursor statement with an over-long cursor name. The resulting overwrite of adjacent memory can crash the hosting application process and may also allow unintended code to run within it. Only deployments that use the Connector for BI's ODBC driver — typically BI and analytics integrations that issue SQL against MongoDB over ODBC — are affected; the data provided names no other MongoDB products or version ranges. No proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no active exploitation is known at this time.

Do: Inventory whether any applications or BI-tool integrations connect to MongoDB through the Connector for BI ODBC driver, and upgrade the driver to a patched release once MongoDB publishes fixed versions (no version numbers are available in the data at hand). In the meantime, restrict SQL submission to trusted low-privilege users and cap or validate cursor-name lengths in application code, and alert on crashes of processes hosting the driver.