Out-of-Bounds Memory Vulnerability in MongoDB

CVE-2026-9753

What is CVE-2026-9753?

A vulnerability exists within the aggregation pipeline of MongoDB where the $_internalApplyOplogUpdate stage can execute a document diff. This can lead to potential out-of-bounds memory access, allowing any authenticated user with sufficient privileges to cause the server to crash or expose sensitive memory contents. This situation arises due to the processing of a malformed binary diff, which can severely impact the stability of the affected MongoDB server.

References