CVE-2026-13077: Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13077?
The severity of CVE-2026-13077 is rated as high with a score of 7.1.
How do I fix CVE-2026-13077?
To fix CVE-2026-13077, ensure that you update to the latest version of MongoDB BSON that addresses this vulnerability.
What type of vulnerability is CVE-2026-13077?
CVE-2026-13077 is an out-of-bounds heap read vulnerability caused by a missing bounds check in BSON CodeWScope element parsing.
Who can exploit CVE-2026-13077?
CVE-2026-13077 can be exploited by authenticated users who generate malformed BSONColumn data containing a CodeWScope element.
What impact does CVE-2026-13077 have on MongoDB?
CVE-2026-13077 can lead to potential information disclosure due to an out-of-bounds heap read, affecting the confidentiality of the system.