This vulnerability (CVE-2026-13071) in MongoDB Server involves a use-after-free condition (CWE-416) triggered by certain aggregation expressions that execute server-side JavaScript. An authenticated user with read access can exploit this flaw to cause the mongod process to terminate unexpectedly. The root cause is improper memory handling during document processing within these aggregation operations. The CVSS 4.0 base score is 7.1, indicating high severity. Affected versions explicitly include 7.0, 8.0, 8.2.0, and 8.3.0. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation results in denial of service by terminating the mongod process. This disrupts database availability for legitimate users. The attacker must have authenticated read access to trigger the issue. There is no indication of data corruption or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict read access to trusted users only and monitor for unusual aggregation queries that execute server-side JavaScript. Avoid running untrusted aggregation expressions that could trigger this vulnerability.