high7.1
CVE-2026-13077
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline.
Impact
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | Mongodb | from 7.0.0 before 7.0.39 from 8.0.0 before 8.0.28 from 8.2.0 before 8.2.12 from 8.3.0 before 8.3.7 |