CVE-2026-82061: Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service
Published Sep 8, 2026
·Updated
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.
Event History
Sep 8, 2026
CVE Published
via MITRE·04:12 PM
Data Sourced
via MITRE·04:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated user with read privileges can trigger the vulnerable condition. Exploitation does not require user interaction.
2
What is the likely operational impact?
The issue can crash the server process, causing a denial of service. It may also result in memory corruption through a write to freed heap memory.
3
What type of activity triggers the flaw?
The vulnerable condition is triggered through a sequence of standard database commands involving the query execution memory tracking subsystem.