The vulnerability CVE-2026-13077 in MongoDB Server arises from a missing bounds check in the BSON CodeWScope element accessors. An authenticated user can exploit this by submitting a specially crafted aggregation pipeline that includes malformed BSONColumn data with a CodeWScope element. This crafted data bypasses wire-level BSON validation. When the server decompresses this data, it uses an unchecked size value in pointer arithmetic, resulting in an out-of-bounds heap read. The impact can be a server crash or disclosure of adjacent heap memory contents. The vulnerability affects specific MongoDB Server versions: 7.0, 8.0, 8.2.0, and 8.3.0. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

An authenticated attacker can exploit this vulnerability to cause a denial of service via server crash or potentially disclose adjacent heap memory contents, which may lead to information leakage. The vulnerability involves an out-of-bounds read due to missing bounds checks in BSON CodeWScope element accessors during decompression of crafted BSON data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user privileges to minimize risk and monitor for unusual activity related to BSON data processing.