CVE-2026-120809

MediumCVSS 6.8/10Last modified Nov 10, 2026

Description

A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream stages to have its underlying memory freed prematurely. An authenticated user can craft an aggregation pipeline under specific conditions to trigger this condition, potentially reading recycled server heap memory in query results or crashing the server. This issue is only triggerable when a non-default server parameter related to the SBE engine is enabled.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 9.0.0, < 9.0.7; >= 8.3.0, < 8.3.16; >= 8.0.0, < 8.0.37

References

https://jira.mongodb.org/browse/SERVER-132279

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-120815.0The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unser CVE-2026-1208106.5An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending CVE-2026-1208115.9A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference CVE-2026-1208126.5An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Unco CVE-2026-1208135.9An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silentl CVE-2026-1208147.2An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrati CVE-2026-1208158.4An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to CVE-2026-1208164.3A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents CVE-2026-1208176.5A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection vali CVE-2026-1208187.1A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed CVE-2026-1208194.3A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only re CVE-2026-120827.5The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthent