This vulnerability (CVE-2026-13065) in MongoDB Server involves a NULL pointer dereference (CWE-476) triggered when a user with read-only privileges constructs an aggregation pipeline using the $linearFill window function operator combined with a particular sortBy expression type. The insufficient validation of the sort specifications during execution causes the mongod process to terminate abnormally, resulting in denial of service. The CVSS 4.0 score is 7.1 (high severity) with network attack vector, low attack complexity, no privileges required beyond read-only, no user interaction, and high impact on availability. The affected versions explicitly include 7.0, 8.0, 8.2.0, and 8.3.0. No patch or remediation level has been provided yet, and there are no known exploits in the wild. This is not a cloud service vulnerability.

An attacker with read-only access can cause the MongoDB server process (mongod) to crash, resulting in denial of service. This disrupts availability of the database service but does not grant elevated privileges or data access beyond read-only. The impact is limited to service interruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict read-only user access to trusted users and monitor for abnormal mongod process terminations. No official fix or temporary workaround has been published at this time.