Description

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-11T19:17:26.170Z",
  "pubdate": "2026-08-11T19:17:26.170Z",
  "executiveSummary": "A vulnerability has been identified within the MongoDB Server query execution engine affecting time-series collections. The flaw involves a use-after-free condition that can be triggered under specific query execution patterns.\nThe primary impact of this vulnerability includes denial of service through a server crash, as well as potential information disclosure resulting from the exposure of freed memory contents embedded within query results.\nThe affected product is MongoDB Server, specifically targeting the query execution engine when processing operations against time-series collections.\nThe risk implications are moderate to high, depending on the sensitivity of the data stored in memory and the operational criticality of the database deployment.\nAttacker capabilities require authenticated access with both read and write privileges within the database environment.\nExploitation requirements dictate that the attacker must construct and execute specific queries targeted at time-series collections to trigger the underlying memory management defect.",
  "technicalDetails": "The root cause of the vulnerability resides in the query execution engine of MongoDB Server, specifically in how internal references are managed during the processing of certain queries against time-series collections. Under specific conditions, the memory backing an internal data structure is deallocated while an internal reference to that memory remains active.\nThe vulnerable component is the query execution engine responsible for handling time-series collection operations. The affected versions encompass MongoDB Server deployments that process time-series queries without the corresponding patches.\nAuthentication requirements mandate that any malicious actor must be an authenticated user. Furthermore, privilege requirements stipulate that the user must possess both read and write privileges to construct and execute the requisite queries.\nThe attack flow proceeds in a step-by-step manner: First, the authenticated user with read and write privileges crafts a specific query targeting time-series collections designed to manipulate internal memory allocations. Second, the query execution engine processes the request, leading to the premature release of underlying memory while an internal reference persists. Third, subsequent operations access the dangling reference, resulting in a use-after-free condition.\nPayload behavior and post-exploitation impact manifest in two primary ways: either the process encounters an invalid memory access leading to an immediate server crash and subsequent denial of service, or the execution engine returns memory contents previously residing in the freed buffer as part of the query results, thereby leaking sensitive data to the unauthorized user."
}