BaseFortify

Publication date: 2025-10-20

Last updated on: 2025-12-04

Assigner: MongoDB, Inc.

Description

An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-20

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-10-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11979

EUVD

EUVD-2025-35086

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 7.0.0 (inc) to 7.0.25 (exc)
mongodb	mongodb	From 8.0.0 (inc) to 8.0.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authorized user to crash the MongoDB server by causing a buffer over-read. It occurs when a Data Definition Language (DDL) operation is issued while queries are being processed under certain conditions.

Impact Analysis

The impact of this vulnerability is that it can cause a denial of service by crashing the MongoDB server, potentially disrupting database availability and operations.

Hi! I’m here to help you understand CVE-2025-11979. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70