Authenticated Read Access to Uninitialized Stack Memory in MongoDB via filemd5 Command

Publication date: 2026-06-09

Last updated on: 2026-06-18

Assigner: MongoDB, Inc.

Description

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-18

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-28

NVD

CVE-2026-9754

EUVD

EUVD-2026-35853

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 8.2.0 (inc) to 8.2.10 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-457	The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user who has the read role to read limited amounts of uninitialized stack memory by issuing specially-crafted filemd5 commands.

Impact Analysis

The impact of this vulnerability is that an attacker with read privileges can access uninitialized stack memory, potentially exposing sensitive information that should not be accessible.

Hi! I’m here to help you understand CVE-2026-9754. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70