CVE-2026-8053 is an out-of-bounds write vulnerability (CWE-787) in MongoDB Server's time-series collection feature. An authenticated user with write privileges can exploit an inconsistency in the internal mapping of field names to indexes within the time-series bucket catalog, causing memory corruption in the mongod process. This memory corruption can potentially lead to arbitrary code execution. The vulnerability affects MongoDB Server versions 5.0 prior to 5.0.33, 6.0 prior to 6.0.28, 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level is provided in the source data, and no known exploits have been reported.

The vulnerability allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process, which can lead to arbitrary code execution. This compromises the confidentiality, integrity, and availability of the MongoDB Server. The impact is high due to the potential for remote code execution without user interaction and low attack complexity.

Patch status is not yet confirmed — check the MongoDB vendor advisory for current remediation guidance. Since no official patch or remediation level is provided in the available data, users should monitor MongoDB's security advisories and apply updates to versions 5.0.33, 6.0.28, 7.0.34, 8.0.23, 8.2.9, or 8.3.2 and later once confirmed. Until patched, restrict database write privileges to trusted users only to reduce risk.