CVE-2026-82063: Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service
A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require local access or user interaction?
No. The vector is network-accessible and requires no user interaction, but the attacker must have authenticated access with low privileges.
How reliable is exploitation likely to be?
The attack complexity is high because it depends on specific timing conditions during cursor operations. This indicates that authentication alone is not sufficient; the required cursor-operation race or sequence must also be achieved.
Is there an expected data confidentiality or integrity impact?
No confidentiality or integrity impact is indicated. The stated impact is high availability impact through a MongoDB Server process crash.