High · published July 23, 2026
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.
| Product | Versions | Fixed in |
|---|---|---|
| mongodb/mongodb | ≥ 7.0.0, < 7.0.39 | 7.0.39 |
| mongodb/mongodb | ≥ 8.0.0, < 8.0.28 | 8.0.28 |
| mongodb/mongodb | ≥ 8.2.0, < 8.2.12 | 8.2.12 |
| mongodb/mongodb | ≥ 8.3.0, < 8.3.7 | 8.3.7 |