CVE-2026-18688

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in MongoDB Server Aggregation

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-18688

EUVD

EUVD-2026-56904

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in MongoDB Server's aggregation framework. An authenticated user can trigger an out-of-bounds memory read by providing a specially crafted numeric parameter in a specific aggregation pipeline stage. This may cause the server to crash (denial of service) and could potentially expose a small amount of memory contents.

Detection Guidance

This vulnerability involves an out-of-bounds memory read in MongoDB's aggregation framework triggered by a specially crafted numeric parameter. Detection requires monitoring for server crashes or unusual memory access patterns during aggregation operations. Check MongoDB logs for segmentation faults or out-of-memory errors related to aggregation pipelines.

Impact Analysis

The impact includes server crashes leading to denial of service, disrupting database operations. There is also a risk of limited memory exposure, which could potentially leak sensitive data depending on the server's memory state at the time of exploitation.

Compliance Impact

This vulnerability could impact compliance by causing data breaches if memory contents are exposed, violating confidentiality requirements in GDPR and HIPAA. Denial of service events may also disrupt access to protected health or personal data, affecting availability requirements.

Mitigation Strategies

Apply the latest MongoDB Server patch immediately. Restrict database access to trusted users only. Disable or closely monitor aggregation pipelines used by untrusted users. Review and update firewall rules to limit exposure to the MongoDB server.

Hi! I’m here to help you understand CVE-2026-18688. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70