The vulnerability CVE-2026-9753 in MongoDB Server arises from improper validation of the specified input type in the $_internalApplyOplogUpdate aggregation pipeline stage. An authenticated user with permission to run the aggregate command can supply a document diff containing a malformed binary diff. This can lead to memory out-of-bounds reads or cause the server to crash. The affected versions explicitly include 7.0.0, 8.0.0, 8.2.0, and 8.3.0. The CVSS 4.0 base score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges required beyond authenticated user, and high impact on confidentiality and availability.

An authenticated user with access to the aggregate command can exploit this vulnerability to cause memory corruption or crash the MongoDB server. This can lead to denial of service or potentially expose sensitive memory contents due to out-of-bounds memory access. There is no indication of privilege escalation or remote code execution in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been provided in the available data. Until a patch is available, restrict aggregate command access to trusted users only and monitor for unusual server crashes.