CVE-2026-82066

HighCVSS 8.1/10Last modified Sep 16, 2026

Description

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-820678.1Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to r CVE-2026-820686.5A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sendi CVE-2026-820696.5A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredact CVE-2026-82077.0Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://githu CVE-2026-820706.5A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insuff CVE-2026-820718.1Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supp CVE-2026-820728.8Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-820736.5A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level CVE-2026-820746.5MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges CVE-2026-820757.5An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client th CVE-2026-820766.5An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/writ CVE-2026-820777.3An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG an