CVE-2026-13075 is a vulnerability in MongoDB where an authenticated user capable of executing aggregation queries can trigger termination of the mongod process by the operating system when the system is under memory pressure. The problem arises specifically through the use of the $rankFusion and $scoreFusion aggregation stages and is rooted in the server's error-handling logic. This can lead to denial of service by exhausting or mishandling memory resources during aggregation operations.

Successful exploitation allows an authenticated user to cause the mongod process to be terminated by the operating system, resulting in a denial of service condition. This impacts availability of the database service. No evidence of privilege escalation or data confidentiality/integrity compromise is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, restrict aggregation query permissions to trusted users only and monitor for unusual aggregation activity involving $rankFusion and $scoreFusion stages.