EUVD-2026-29888
GHSA-pr63-cc36-q84h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.
This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
AnalysisAI
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authenticated users with database write privileges. Affects all active release branches (5.0 through 8.3) when exploiting field-name-to-index mapping inconsistencies in the time-series bucket catalog. EPSS score of 0.06% (20th percentile) suggests low widespread exploitation probability despite high CVSS 8.7, but requires authentication and database privileges, limiting attack surface to insider threats or compromised application credentials. No public exploit code or CISA KEV listing identified at time of analysis.
Technical ContextAI
This vulnerability resides in MongoDB's time-series collection implementation, a specialized storage optimization introduced in MongoDB 5.0 for efficiently handling temporal data streams. Time-series collections use bucketed storage where documents are compressed into internal bucket structures with field-name-to-index mappings to reduce disk footprint. The CWE-787 (Out-of-Bounds Write) flaw occurs in the mongod process when the bucket catalog's internal mapping becomes inconsistent during write operations. This memory corruption primitive can be leveraged to overwrite adjacent memory regions, potentially hijacking control flow. The issue spans six major release branches spanning from MongoDB 5.0 (released July 2021) through the current 8.3 development series, indicating a longstanding architectural flaw in the time-series bucket management code rather than a recent regression. The CPE string confirms this affects MongoDB Server specifically, not community forks or downstream distributions.
RemediationAI
Upgrade to patched MongoDB Server versions: 5.0.33, 6.0.28, 7.0.34, 8.0.23, 8.2.9, or 8.3.2 or later as appropriate for your deployment branch. Vendor-confirmed fix versions are available through MongoDB Download Center and package repositories. Refer to JIRA SERVER-126021 for official upgrade guidance and release notes. Organizations unable to immediately patch should implement compensating controls: (1) Restrict database write privileges to only essential application service accounts using MongoDB role-based access control (use roles like read or readWrite instead of dbOwner or root where possible); (2) Deploy network segmentation to limit MongoDB access to trusted application tiers only, blocking direct database access from user networks; (3) Enable MongoDB audit logging to monitor anomalous write patterns to time-series collections; (4) If time-series collections are not operationally required, consider migrating data to standard collections until patching is complete (trade-off: loss of storage optimization and query performance benefits specific to temporal data). Note that disabling time-series features entirely requires data migration and application code changes, making rapid patching the preferred remediation path for production systems.
More in Mongodb Server
View allAuthorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthentic
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network acc
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by trigger
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today