CVE-2026-82066: Heap Out-of-Bounds Read in MongoDB Server Query Planning Component
A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with database read and write privileges can trigger it using crafted query operations. Unauthenticated users and users without those database privileges are not identified as able to exploit it.
What information could an attacker obtain?
The server may read memory beyond allocated buffer boundaries, and portions of that memory may be observable through diagnostic query statistics output. The available information indicates confidentiality impact only; it does not describe integrity or availability impact.
What conditions are needed for exploitation?
The attacker needs valid authentication, database read and write privileges, and the ability to submit crafted queries. No user interaction is required.