CVE-2026-18688: Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18688?
CVE-2026-18688 has a high severity score of 7.1.
What is the impact of CVE-2026-18688?
CVE-2026-18688 can lead to denial of service due to an out-of-bounds memory read.
How do I fix CVE-2026-18688?
To fix CVE-2026-18688, it is recommended to update to the latest version of MongoDB that addresses this vulnerability.
Who is affected by CVE-2026-18688?
CVE-2026-18688 affects authenticated users of the MongoDB Server leveraging the aggregation framework.
What versions of MongoDB are impacted by CVE-2026-18688?
Specific versions of MongoDB Server prior to the security update related to CVE-2026-18688 are impacted.