CVE-2026-82061

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in MongoDB Server

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: MongoDB, Inc.

Description

A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-82061

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in MongoDB's server query execution memory tracking subsystem. An authenticated user with read privileges can exploit it by sending a series of standard database commands that cause the server to write to freed heap memory. This can lead to server crashes or memory corruption.

Detection Guidance

This vulnerability involves a use-after-free issue in MongoDB's query execution memory tracking. Detection requires monitoring for server crashes or memory corruption during standard database operations. Check MongoDB logs for segmentation faults or heap corruption errors. Enable core dumps for post-crash analysis. Use tools like gdb to analyze crash dumps if available.

Impact Analysis

This vulnerability can cause your MongoDB server to crash or experience memory corruption. As an authenticated user with read privileges, an attacker could exploit it to disrupt database operations or potentially execute arbitrary code, leading to data loss or unauthorized access.

Mitigation Strategies

Upgrade MongoDB to the latest patched version immediately. Restrict database access to trusted users only. Disable unnecessary read privileges for users. Monitor server stability and memory usage closely. Consider temporary isolation of affected systems until patched.

Hi! I’m here to help you understand CVE-2026-82061. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70