---
id: CVE-2026-82066
title: >-
  A heap out-of-bounds read security issue exists in the query planning
  component of MongoDB Server
summary: >-
  A heap out-of-bounds read security issue exists in the query planning
  component of MongoDB Server. An authenticated user with database read and
  write privileges can trigger the security issue through crafted query
  operations, causing the…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-125
vendor: mongodb
product: mongodb
affected:
  - 'mongodb >= 7.0.0, < 7.0.41'
  - 'mongodb >= 8.0.0, < 8.0.30'
  - 'mongodb >= 8.3.0, < 8.3.9'
patched:
  - mongodb 8.3.9
published: '2026-09-08'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:37:42.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82066'
references:
  - url: 'https://jira.mongodb.org/browse/SERVER-131562'
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
epss: 0.00388
epssPercentile: 0.30053
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T17:54:34.882403Z'
ingestedAt: '2026-09-08T16:34:19.257Z'
---

## Overview

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.

## Affected

- `mongodb >= 7.0.0, < 7.0.41`
- `mongodb >= 8.0.0, < 8.0.30`
- `mongodb >= 8.3.0, < 8.3.9`

## Remediation

Upgrade past the affected range:

- `mongodb 8.3.9`