MongoDB Server EUVD-2026-98811

Requires an authenticated session with read privileges (PR:L) on the target MongoDB Server; there is no unauthenticated path. The attacker must issue an aggregate command that specifically combines an internal aggregation stage with a cursor batch size of 0 - that exact option combination IS the triggering condition. Reliable data disclosure is further limited by timing (AT:P): the freed memory must be reused with other data before the server reads it, so leaked contents are non-deterministic and may instead manifest as a process crash. Limiting factors for defenders: valid credentials are mandatory, no user interaction of a victim is needed (UI:N), and the impact is bounded to confidentiality/availability of the mongod process rather than integrity or code execution.

This is a moderate-priority issue rather than an emergency. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H) scores 6.0 (medium): network-reachable (AV:N) and low attack complexity (AC:L), but gated by two meaningful dampeners - the attacker must already hold valid credentials with read privileges (PR:L, so NOT unauthenticated) and a specific attack requirement must be met (AT:P), reflecting that the freed memory must be reused with meaningful data before it is read. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - all three signals point to this not being under active mass exploitation. The primary impact is confidentiality (VC:H: leakage of unrelated process memory into query results), with integrity and the vendor's availability metric both marked N. However, the description explicitly states the server process 'may also terminate unexpectedly,' which conflicts with the vendor's VA:N rating - this suggests a real but likely non-deterministic denial-of-service dimension that the official vector understates; verify availability impact with MongoDB. Net: a genuine information-disclosure bug worth patching in a normal maintenance cycle, elevated in multi-tenant deployments where low-privilege read users should not see other tenants' data, but not a high-urgency, internet-facing, unauthenticated threat.

An authenticated user holding only read privileges issues an aggregate command that combines an internal aggregation stage with a cursor batch size of 0, triggering a use-after-free. The server reads from released memory that may have been reused, returning unrelated in-process data (potentially another tenant's or user's data) to the client, and under some memory states crashes the mongod process. No public exploit code is identified at time of analysis, and reliable disclosure is non-deterministic because it depends on memory reuse timing (AT:P).