CVE-2026-18694

HighCVSS 7.1/10Last modified Oct 23, 2026

Description

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a server crash (denial of service) and may expose a limited amount of server process memory.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-186956.5An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticaCVE-2026-186966.5An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain dataCVE-2026-186977.5An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexCVE-2026-186985.4An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected systCVE-2026-186996.5An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to termiCVE-2026-18705.3The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data dCVE-2026-187006.5An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference toCVE-2026-187016.5An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminateCVE-2026-187026.4An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings CVE-2026-187034.2An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certCVE-2026-187046.5An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations aCVE-2026-187056.5An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve document
CVE-2026-18694: High severity, CVSS 7.1 | Vulnix