CVE-2026-13072: CWE-122: Heap-based Buffer Overflow in MongoDB MongoDB Server
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.
AI Analysis
Technical Summary
CVE-2026-13072 is a critical heap-based buffer overflow vulnerability (CWE-122) in MongoDB Server affecting versions 7.0, 8.0, 8.2.0, and 8.3.0. It arises when compute mode is enabled on a standalone mongod instance, where insufficient validation of BSON data from external sources during aggregation pipeline processing can cause memory corruption. This may result in process termination or other unintended effects. The vulnerability requires explicit enablement of compute mode, which is not the default configuration. As of the published date, no official patch or remediation level has been announced by MongoDB.
Potential Impact
Exploitation of this vulnerability can lead to memory corruption in the MongoDB Server process, potentially causing it to terminate unexpectedly or behave unpredictably. This could disrupt database availability or integrity in affected deployments where compute mode is enabled. Since compute mode is not enabled by default, only instances explicitly configured with this mode are at risk.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling compute mode on standalone mongod instances if possible. Monitor MongoDB's official advisories for updates regarding patches or mitigations.
CVE-2026-13072: CWE-122: Heap-based Buffer Overflow in MongoDB MongoDB Server
Description
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.
CVSS v4.0
Score 9.2critical
Affected software
pkg:github/mongodb/mongoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-13072 is a critical heap-based buffer overflow vulnerability (CWE-122) in MongoDB Server affecting versions 7.0, 8.0, 8.2.0, and 8.3.0. It arises when compute mode is enabled on a standalone mongod instance, where insufficient validation of BSON data from external sources during aggregation pipeline processing can cause memory corruption. This may result in process termination or other unintended effects. The vulnerability requires explicit enablement of compute mode, which is not the default configuration. As of the published date, no official patch or remediation level has been announced by MongoDB.
Potential Impact
Exploitation of this vulnerability can lead to memory corruption in the MongoDB Server process, potentially causing it to terminate unexpectedly or behave unpredictably. This could disrupt database availability or integrity in affected deployments where compute mode is enabled. Since compute mode is not enabled by default, only instances explicitly configured with this mode are at risk.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling compute mode on standalone mongod instances if possible. Monitor MongoDB's official advisories for updates regarding patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-06-23T18:00:16.599Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6123209c2644c7f89b2ccc
Added to database: 07/22/2026, 20:08:00 UTC
Last enriched: 07/30/2026, 03:47:44 UTC
Last updated: 09/03/2026, 22:52:09 UTC
Views: 414
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.