CVE-2026-18700Medium· 6.5▾ SunlitAn issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a coll…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.
mongodb >= 7.0.0, < 7.0.40mongodb >= 8.0.0, < 8.0.29mongodb >= 8.2.0, <= 8.2.12mongodb >= 8.3.0, < 8.3.8mongodb = 9.0.0mongodb = 9.1.0Upgrade past the affected range:
mongodb 8.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82056Medium· 5.3A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths
CVE-2026-82061High· 8.1A use-after-free security issue exists in the server's query execution memory tracking subsystem
CVE-2026-82063Medium· 5.3A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service
CVE-2026-18706Medium· 6.6An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed
CVE-2026-18692High· 8.8An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed
CVE-2026-88032Medium· 5.9A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled