CVE-2026-11933

HighCVSS 8.8/10Last modified Jun 22, 2026

Description

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787 CWE-416

Affected software

Vendor	Product	Versions
MongoDB	MongoDB	>= 8.3.0, <= 8.3.3; >= 8.2.0, <= 8.2.10; >= 8.0.0, <= 8.0.25; >= 7.0.0, <= 7.0.36; >= 6.0, <= 6.0.28; >= 5.0, <= 5.0.33; >= 4.4.0, <= 4.4.30

References

https://jira.mongodb.org/browse/SERVER-128125Patch, Vendor Advisory

Timeline

Published: Jun 12, 2026
Last modified: Jun 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1193303.5Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId CVE-2026-1193317.1Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRul CVE-2026-1193328.8Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries CVE-2026-1193337.8draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare e CVE-2026-1193342.2Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh CVE-2026-1193357.8Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Sc CVE-2026-1193367.8Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the CVE-2026-1193377.1RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invoke CVE-2026-1193386.9Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned righ CVE-2026-1193395.5Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and cal CVE-2026-119347.2IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation o CVE-2026-1193405.5Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions a