This vulnerability (CVE-2026-9753) in MongoDB Server arises from improper validation of the specified input type in the $_internalApplyOplogUpdate aggregation pipeline stage. An attacker with authenticated access and permission to run the aggregate command can supply a malformed binary diff document, potentially triggering memory out-of-bounds conditions or crashing the server. The CVSS 4.0 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges required beyond authenticated user, and no user interaction needed. No official remediation or patch information is currently available, and no known exploits have been reported in the wild.

Successful exploitation can lead to memory corruption or server crashes, impacting availability of the MongoDB Server. Since any authenticated user with aggregate command access can trigger this, it may allow denial of service conditions. There is no indication of data confidentiality or integrity compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict aggregate command access to trusted users only and monitor for unusual server crashes. No official fix or temporary workaround is currently documented.