CVE-2026-82061

HighCVSS 8.1/10Last modified Sep 16, 2026

Description

A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-820625.5A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the a CVE-2026-820635.3A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of servi CVE-2026-820647.5A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set mem CVE-2026-820656.5A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges t CVE-2026-820668.1A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read CVE-2026-820678.1Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to r CVE-2026-820686.5A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sendi CVE-2026-820696.5A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredact CVE-2026-82077.0Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://githu CVE-2026-820706.5A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insuff CVE-2026-820718.1Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supp CVE-2026-820728.8Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via