CVE-2026-13072 is a critical heap-based buffer overflow vulnerability in MongoDB Server. It occurs when compute mode is enabled on a standalone mongod instance, allowing insufficient validation of externally sourced BSON data during aggregation pipeline processing. This can lead to memory corruption, which may cause the process to terminate unexpectedly or exhibit other unintended behaviors. The vulnerability affects explicitly enabled compute mode configurations in MongoDB Server versions 7.0, 8.0, 8.2.0, and 8.3.0. The CVSS 4.0 score is 9.2, indicating a critical severity with network attack vector, high complexity, and no privileges or user interaction required.

Successful exploitation of this vulnerability can cause memory corruption in the MongoDB server process, potentially resulting in process termination or other unintended behaviors. This could disrupt database availability or stability. The vulnerability requires compute mode to be explicitly enabled, which is not the default configuration, limiting exposure to systems with this mode active.

No official patch or remediation is currently available for this vulnerability. Since the affected configuration (compute mode enabled on standalone mongod) is non-default and requires explicit enablement, disabling compute mode if not needed can mitigate exposure. Monitor vendor advisories for updates or patches addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.