CVE-2026-82061High· 8.1▾ TwilightA use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leadi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.
mongodb >= 8.3.0, < 8.3.9Upgrade past the affected range:
mongodb 8.3.9Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82056Medium· 5.3A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths
CVE-2026-82063Medium· 5.3A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service
CVE-2025-11979Medium· 5.3An authorized user may crash the MongoDB server by causing buffer over-read
CVE-2026-18711High· 7.1An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries again…
CVE-2026-18706Medium· 6.6An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed
CVE-2026-18700Medium· 6.5An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a coll…