Description

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-11T19:17:23.450Z",
  "pubdate": "2026-08-11T19:17:23.450Z",
  "executiveSummary": "An out-of-bounds memory access vulnerability exists within MongoDB Server's handling of timeseries collections.\nThe vulnerability allows an authenticated user with write privileges to corrupt internal data structures through the insertion of specific documents.\nSubsequent insert operations targeting the affected bucket trigger memory access outside intended bounds.\nThe impact of successful exploitation includes denial of service via server crashes, potential exposure of limited memory contents, and memory corruption.\nExploitation requires authentication and write privileges against the affected MongoDB Server instance.",
  "technicalDetails": "The vulnerability resides in the internal component of MongoDB Server responsible for processing and managing timeseries collections and bucket data structures.\nAuthentication is required, and the attacker must possess write privileges within the database environment.\nThe attack flow begins when an authenticated user with write access inserts specific crafted documents into a timeseries collection.\nThis initial operation causes an internal data structure representing the timeseries bucket to enter an inconsistent state.\nFollowing the initial corruption, a subsequent insert operation into the affected bucket forces the storage engine to interact with the malformed data structure.\nDue to the internal state inconsistency, the server attempts to resolve memory offsets based on untrusted or corrupted bucket metadata.\nThis results in the server reading or writing memory outside its intended bounds.\nThe consequence of this out-of-bounds memory access manifests as a server crash leading to denial of service, potential information disclosure of limited memory contents, or unpredictable memory corruption."
}