CVE-2026-13077
published 2026-07-22CVE-2026-13077: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline…
PriorityP338high7.1CVSS 3.1
AVNACLPRLUINSUCLINAH
EPSS
0.42%
35.3th percentile
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 7.0.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb | >= 8.0.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb | >= 8.3.0 < 8.3.7 | 8.3.7 |
| mongodb | mongodb_server | >= 7.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb_server | >= 8.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb_server | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb_server | >= 8.3.0 < 8.3.7 | 8.3.7 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline.
ghsa_unreviewed·2026-07-22
CVE-2026-13077 [HIGH] CWE-125 A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline.
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.
VulDB
MongoDB Server up to 7.0.38/8.0.27/8.2.11/8.3.6 Aggregation out-of-bounds
vuldb·2026-07-22·CVSS 7.1
CVE-2026-13077 [HIGH] MongoDB Server up to 7.0.38/8.0.27/8.2.11/8.3.6 Aggregation out-of-bounds
A vulnerability identified as problematic has been detected in MongoDB Server up to 7.0.38/8.0.27/8.2.11/8.3.6. This issue affects some unknown processing of the component Aggregation Handler. Performing a manipulation results in out-of-bounds read.
This vulnerability is cataloged as CVE-2026-13077. It is possible to initiate the attack remotely. There is no exploit available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-22
Published