CVE-2026-18694

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in MongoDB Server via Geospatial Queries

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a server crash (denial of service) and may expose a limited amount of server process memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-18694

EUVD

EUVD-2026-56917

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves MongoDB Server's geospatial query processing. An authenticated user with write privileges can store malformed geometry data that bypasses validation. Later queries on this data may cause the server to access memory outside its intended bounds, leading to a server crash (denial of service) and potential exposure of limited server process memory.

Detection Guidance

This vulnerability involves malformed geometry data in MongoDB's geospatial queries. Detection requires monitoring for unusual memory access patterns or crashes during geospatial operations. Check MongoDB logs for segmentation faults or memory access errors after executing geospatial queries. Use system monitoring tools like 'dmesg' or 'journalctl' to identify abnormal process terminations.

Impact Analysis

If exploited, this vulnerability could cause your MongoDB server to crash, disrupting services and leading to downtime. It may also expose a small amount of sensitive server memory, potentially leaking information. Users with write access could trigger this issue unintentionally or maliciously.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions (affecting availability) or exposing limited server memory (potentially leaking data). GDPR requires protecting personal data integrity and availability, while HIPAA mandates safeguarding health information. A crash or memory exposure may violate these requirements.

Mitigation Strategies

Update MongoDB Server to the latest patched version to address the geospatial query processing issue. Restrict write privileges to trusted users only and avoid storing malformed geometry data. Monitor server logs for unusual queries or crashes.

Hi! I’m here to help you understand CVE-2026-18694. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70