This vulnerability (CVE-2026-82066) involves a heap out-of-bounds read in MongoDB Server's query planning component. It can be triggered by an authenticated user possessing read and write privileges on the database by submitting specially crafted queries. The flaw causes the server to read memory outside the allocated buffer, potentially leaking partial memory contents via diagnostic query statistics. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, and limited confidentiality impact. Affected versions explicitly include MongoDB Server 7.0.0, 8.0.0, and 8.3.0. There is no vendor-provided patch or remediation level indicated, and no known exploitation in the wild has been reported.

An authenticated user with read and write privileges can cause the MongoDB Server to read memory beyond allocated boundaries, potentially exposing partial memory contents through diagnostic outputs. This could lead to unintended information disclosure, but the impact is limited to confidentiality with no reported integrity or availability effects. The vulnerability requires authentication and privileges, reducing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor MongoDB vendor advisories for updates. Restricting database user privileges to the minimum necessary may reduce risk until a fix is available.