CVE-2026-18692High· 8.8▾ TwilightAn issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations coul…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.
mongodb >= 8.0.0, < 8.0.29mongodb >= 8.2.0, <= 8.2.12mongodb >= 8.3.0, < 8.3.8mongodb = 9.0.0mongodb = 9.1.0Upgrade past the affected range:
mongodb 8.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82056Medium· 5.3A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths
CVE-2026-82061High· 8.1A use-after-free security issue exists in the server's query execution memory tracking subsystem
CVE-2026-82063Medium· 5.3A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service
CVE-2026-18706Medium· 6.6An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed
CVE-2026-18700Medium· 6.5An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a coll…
CVE-2026-88032Medium· 5.9A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled