AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MongoDBCVE-2026-82066

MongoDB Server: out-of-bounds read

MongoDB

CVE-2026-82066 · Published Sep 8, 2026 · updated Sep 16, 2026

Medium5.3
Fix: upgrade to 8.3.9 or later (3 fixed versions below)
MongoDB advisory

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.

Affected versions

PackageAffectedFixed in
MongoDB Server
Product
>= 8.3.0, < 8.3.98.3.9
>= 8.0.0, < 8.0.308.0.30
>= 7.0.0, < 7.0.417.0.41
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-125

More MongoDB advisories

All MongoDB